Security
Reporting a vulnerability and checking your downloads.
Reporting a vulnerability
Email security@ow-ops.eu with a description of the issue, the affected project and version, and steps to reproduce it. Please do not open a public issue for security problems.
This policy is also published as security.txt, following RFC 9116.
Verifying downloads
passoword and towonel publish every release file with a SHA-256 checksum and a cosign signature, next to the file on the release page. apoci releases include a checksums file. Check them before installing.
Design documents
passoword publishes its protocol and threat model. Its protocol has not been independently audited yet.
Source code
The source code of each project: