The ktls-utils project values the independent security research community and believes that responsible disclosure of security vulnerabilities helps ensure the security and privacy of all users.

Please do NOT raise a GitHub Issue to report a security vulnerability. If you believe you have found a security vulnerability, please send a report to the project maintainer, Chuck Lever cel@kernel.org, or to the ktls-utils developer mailing list at kernel-tls-handshake@lists.linux.dev, preferably with a proof of concept. Note that the mailing list is publicly archived; send reports that require confidential handling to the maintainer directly.

Non-vulnerability related security issues including ideas for new or improved security features are welcome on GitHub Issues.

Security fixes are released as new ktls-utils versions. Release notes in the NEWS file describe the fixes each version carries.

Security related information such as a threat model, considerations for secure use, or any known security issues is provided in the project documentation.