Please do not open a public issue for a security vulnerability.

Report it privately through GitHub Security Advisories, which creates a private channel with the maintainers.

Please include:

• A description of the vulnerability and its impact
• Steps to reproduce, or a proof of concept
• Affected version, platform and configuration
• Any suggested fix

What to expect

You will be credited in the advisory unless you prefer otherwise.

In scope

• Anything that discloses vault contents without the correct credentials
• Weaknesses in the cryptographic design or its implementation
• Memory-safety issues in protocol parsing
• Secrets leaking into logs, error messages, crash dumps, argv or temporary files
• Sandbox escapes from the plugin system
• Missing or bypassable host key and certificate verification
• Anything in the import parsers reachable by a crafted file

Out of scope — stated in the threat model, not dismissively but because no user-space application can address them:

• Attacks requiring root, kernel access or physical memory capture
• Malware already running as the user
• Weak master passwords chosen by the user
• Social engineering
• Denial of service against a remote host

The project actively wants review of its cryptographic design before it is implemented. The specifications are public for that reason:

• Threat model
• Vault format
• Key management
• Transport security

If you have applied-cryptography experience and are willing to look at these, that is among the most valuable contributions the project can receive right now. An independent review of the vault format is a release gate for v1.0.

Design feedback is welcome as a public issue — a design discussion is not a vulnerability report.

The project is pre-release. Once v1.0 ships, the latest minor release will receive security fixes.

• Security issues are prioritised over features
• Fixes are released promptly, with an advisory explaining the issue
• We will not quietly patch a vulnerability without disclosing it
• We will state plainly when something cannot be fixed, and why