Report privately through GitHub Security Advisories on this repository, or by email to security@keeplane.dev. Please do not open a public issue.

Include what you did, what happened, and what you expected. A proof of concept helps; a working exploit is not required.

What to expect:

Credit is given by default. Tell us if you would rather not be named. There is no bug bounty — this is an unfunded project, and pretending otherwise would waste your time.

In scope: anything that breaks a stated security property —

• A database dump yielding plaintext credential material
• Any path that returns decrypted credential material over HTTP
• Cross-tenant access to connections, credentials, policy or audit
• SSRF through the proxy, or any way to make the credential reach a caller-chosen host
• Refresh-token corruption: two workers both committing, or a zombie overwriting a live token
• A secret appearing in a log line, span, error string or audit record
• Audit forgery that offline verification does not detect
• Auth-profile handling that executes anything (profiles are data, never code)

Out of scope: findings that require host root on the deployment (see accepted risk #1 in NON-GOALS.md), missing hardening headers on the admin UI without an exploit path, and anything that requires a modified keeplane binary.

Pre-v1.0, only the latest release receives fixes. An LTS line with a security-patch SLA is planned for after v1.0.

Releases are built with CGO_ENABLED=0 -trimpath, published with an SBOM (syft) and signed with cosign keyless. Verification instructions ship with each release.

• Every security mechanism stays open, forever — see OPEN-CORE-PROMISE.md
• The threat model is published and kept current: THREAT-MODEL.md
• The adversarial test suite is public and separately runnable: make conformance
• Accepted risks are documented rather than hidden