SECURITY.md
This Kit feature is not available yet.
At 26cf72cCopy the commit ID
At 26cf72cCopy the commit ID
Please do not file public GitHub issues for security vulnerabilities.
Preferred: open a private report through GitHub Security Advisories at https://github.com/officialunofficial/mkit/security/advisories/new. This routes the report to the maintainers privately, gives us a place to collaborate on a fix, and produces a CVE on request.
If you cannot use GitHub Security Advisories for any reason, contact the
maintainers privately by opening a draft PR titled SECURITY: contact me
out-of-band (no details in the body) and we will reach out.
We aim to:
If you do not hear back within the acknowledgement window, please nudge us — notifications can drop.
Only the latest minor line receives security fixes.
| Version | Supported |
|---|---|
| 0.3.x | Yes (current) |
| < 0.3 | No |
Pre-1.0 releases may ship breaking format changes alongside security fixes. Read the CHANGELOG before upgrading.
We will not pursue legal action against researchers who follow this process in good faith, including accidental disclosure during testing.
The initial release narrows the local attack surface around keys and config. Briefly:
<repo>/.mkit/config that tries to set
them is rejected with a warning and the value is ignored.O_NOFOLLOW,
written atomically (tmp plus fsync plus rename plus parent fsync), and
owner-checked against the running euid. Parent directory is
enforced 0700.mkit verify-attest defaults to
$XDG_CONFIG_HOME/mkit/trust-roots.toml, not a repo-local path,
so a hostile clone cannot choose its own verifier.Full description, attacker models, and verification gates in
docs/THREAT-MODEL.md.
We don't publish a long-lived PGP key. GitHub Security Advisories provides transport-layer privacy and a private collaboration channel, which we believe is sufficient for the current scope. If you have a strong need for end-to-end encryption beyond TLS, mention this in the initial advisory and we'll arrange an out-of-band channel.
We do not currently offer a paid bug bounty. Researchers will be
credited in the published advisory and in CHANGELOG.md.
This project contains cryptographic software (BLAKE3, Ed25519, secp256k1, P-256, AES, rustls/TLS). Source code distribution is covered under the publicly-available open-source exemption (US EAR §740.13(e); ECCN 5D002.c.1; License Exception TSU). A §740.13(e) notification has been provided to BIS (crypt@bis.doc.gov) and ENC (enc@bis.doc.gov) at the time of public launch.
In scope:
mkit binary and the Rust workspace under rust/crates/ —
including the library crates published to crates.io (mkit-core,
mkit-rpc, mkit-attest, mkit-keystore, mkit-git-bridge, mkit-sync, the
mkit-transport-* crates).contrib/signers/.docs/specs/SPEC-*.md).Out of scope (please report to upstream instead):