KeylessOps sits on a credential and authorization boundary. We take reports of authentication bypass, secret exposure, SSRF, policy bypass, token forgery/replay, audit tampering, and unsafe upstream forwarding especially seriously.
Before a stable release, only the latest commit on the default branch receives security fixes. After versioned releases begin, this table will name supported release lines.
Please do not open a public issue, discussion, or pull request for a suspected vulnerability.
Use GitHub's private vulnerability reporting / Security Advisory flow for ytvchsy/KeylessOps:
https://github.com/ytvchsy/KeylessOps/security/advisories/new
Include, when safe:
- affected commit or version;
- impact and the trust boundary crossed;
- minimal reproduction steps or a proof of concept;
- required configuration, including whether private upstreams were enabled;
- suggested mitigations;
- whether you believe exploitation is active.
Never include live credentials, administrator or agent tokens, customer data, or production host details. Use canary values in reproductions.
We aim to acknowledge a complete report within 5 business days and provide an initial assessment within 10 business days. Complex fixes may take longer. We will coordinate disclosure timing and credit with the reporter. Please allow a reasonable remediation window before public disclosure.
The local encrypted store is explicitly development-only. Reports that only demonstrate that a process with the master key can decrypt its own store are expected behavior. Reports remain in scope when they show unauthorized key access, cryptographic misuse, API disclosure, privilege escalation, or a bypass of the documented trust boundaries.
The following MVP limitations are documented, not security guarantees:
- no TLS termination (a TLS reverse proxy/service mesh is required remotely);
- no multi-tenant isolation or HA;
- no online master-key rotation;
- no production-grade external secret manager in the basic local mode;
- no server-enforced two-stage approval workflow yet.
See the threat model for assets, assumptions, adversaries, residual risks, and validation priorities.
If a real secret or token may be compromised, revoke/rotate it at the issuer first, isolate the gateway, preserve metadata-only evidence, and rebuild from trusted artifacts. A vulnerability report is not an incident-response service and should not delay containment.