Kaasu confirms payments, so we treat security reports as the highest priority.
Use Report a vulnerability on GitHub. It is private. Please do not open a public issue or pull request for a security problem.
Include what you found, how to reproduce it, and what an attacker could do. A redacted bank alert sample is fine; never send real customer data or live keys.
| Step | Target |
|---|---|
| We acknowledge your report | within 3 working days |
| We confirm or explain why it is not a vulnerability | within 10 working days |
| We ship a fix for critical and high issues | within 30 days |
| We publish an advisory and credit you, if you want | with the fix |
Anything that could make an order show as paid without a verified bank alert, expose payer or account data, bypass admin sign-in, forge or replay a device alert or webhook, tamper with the ledger without detection, or compromise a release.
Reports that need physical access to the owner's server, social engineering of maintainers, volume-based denial of service, and findings in third-party services we do not control.
If you act in good faith, stay within this policy, and give us a reasonable time to fix, we will not take legal action against you.
Kaasu is pre-release. Only main is supported until the first tagged release.
See the threat model for what we already defend against.
Each release ships binaries, SHA256SUMS, an SPDX SBOM and a Sigstore signature per file. To check one:
sha256sum --ignore-missing -c SHA256SUMS # checks only the files you downloaded
cosign verify-blob --certificate kaasu-linux-amd64.pem --signature kaasu-linux-amd64.sig \
--certificate-identity-regexp 'https://github.com/opensawce/kaasu/.github/workflows/release.yml@.*' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com kaasu-linux-amd64