Security
Report a vulnerability in private. This covers the identikey-core code and the production provider at auth.identikey.me.
That opens a private advisory. Do not open a public GitHub issue, and do not post exploit details, credentials, or account data in a public channel. There is no bounty.
What to include
- What an attacker can do, and who is affected
- The component: the hosted provider, a crate, or this website
- The version, commit, or what you saw in production
- Steps to reproduce, or why a reproduction is not safe to run
Give us time to confirm and fix the issue before any public write-up. We will answer on the advisory.
Please do not access another person's account, change their data, or interrupt the service to demonstrate a finding. A description plus a proof against your own account or a local checkout is enough.
Machines should read security.txt. Ordinary bugs and feature requests stay on GitHub issues.