The WebAuth project takes security vulnerabilities seriously. If you discover a security issue, please report it responsibly so it can be investigated and addressed.

Security contact: security@klasker.com

When reporting a vulnerability, please include, where possible:

• A clear description of the vulnerability and its potential impact.
• The steps required to reproduce the issue.
• The affected WebAuth version, browser and operating system.
• Any relevant logs, screenshots or proof-of-concept material that helps demonstrate the issue.

Please avoid including real passwords, authentication secrets, recovery keys, authenticator seed values or other sensitive personal data in your report.

• Please report suspected vulnerabilities privately by email before publicly disclosing technical details.
• Allow reasonable time for investigation, remediation and release of a fix before publishing details.
• Do not access, modify or disclose other people's data, and do not perform destructive testing.
• Reports are welcome for WebAuth itself and for security weaknesses in its handling of authentication credentials, local storage, encrypted exports, imports and interoperability with KAMBOS.

Security fixes will generally be prioritised for the latest maintained WebAuth release. Older releases may not receive security updates.

This policy covers security vulnerabilities in the WebAuth browser extension and its project-maintained code, including its authentication functions, credential storage, encryption, backup and recovery mechanisms, import/export features, and browser permissions.

Vulnerabilities in third-party browsers, libraries or services should be reported to their respective maintainers where appropriate. If a third-party issue creates a demonstrable security vulnerability in WebAuth, please also report its impact on WebAuth.

The project will endeavour to acknowledge reports, investigate their validity and severity, and communicate relevant remediation or mitigation information. Response and remediation times may vary according to severity, complexity and maintainer availability.

Please use the security contact above for vulnerability reports rather than public issue trackers.