Security fixes are accepted against the current main branch of this repository.
Please do not open a public GitHub issue for security bugs that could lead to secret disclosure, key recovery, or vault integrity bypass.
Prefer one of:
- GitHub Private vulnerability reporting (Security tab), if enabled on the repository
- Contact the maintainers privately using the channel listed in the repository profile / release notes
Include:
- LPMS version or commit hash
- OS version
- Steps to reproduce
- Impact (e.g. ciphertext forgery, key leak, auth bypass)
- Whether you have a suggested fix
Please allow reasonable time for a fix before public disclosure.
LPMS assumes a trustworthy host while the vault is unlocked. Issues that require malware, admin privileges, or physical memory access on an unlocked session are generally out of threat model (see docs/THREAT_MODEL.md), but we still welcome reports that clarify boundaries or improve hardening.
Cryptographic design details: docs/SECURITY.md.