Skip to content
Security

Report a vulnerability

Found a security problem in www.nauthera.io or in Nauthera? Tell us privately. This page says what is in scope, what to send, what we ask you not to do and what to expect from us.

By Michael Beutler, FounderPublished

security@nauthera.ioIn English or German. Never a public issue.

How Nauthera is built

  • Every release scans the server and operator images with Trivy, signs them keyless with cosign and ships them for amd64 and arm64 with an SBOM and build provenance; the signed Helm chart pins both by digest (Installation).
  • CI runs govulncheck on the server and the operator and holds every third-party action to a commit.
  • Audit records are hash-chained, with signed checkpoints copied to the application log, and nauthera-server audit verify exposes a rewritten row (Tamper evidence).
  • The server mints each client secret and keeps only its hash; signing keys and TOTP seeds are encrypted at rest, and an organization's keys are bound to it (Keys & Secrets).
  • Static binaries on scratch images run as non-root on a read-only root filesystem with every Linux capability dropped.
  • Unsafe settings for a production issuer stop the server at startup, and the chart names each one before anything is installed (Startup guards).

How to report

  • Email security@nauthera.io. Don't open a public GitHub issue, and don't post the details anywhere public before a fix is out.
  • If the details are sensitive, send a first message without them and we'll agree on a way to share them.

Scope

In scope:

  • The website: www.nauthera.io, nauthera.io and everything they serve, including the docs, the MCP server at /mcp, the waitlist form, team sign-in and the API routes behind them.
  • Nauthera's releases: the server, the operator, their container images and the Helm chart, which anyone can pull from the GitHub Container Registry. Test them on a deployment you run.

Out of scope:

  • Testing a deployment of Nauthera that someone else runs, unless they allow it. A flaw in the software itself is in scope wherever you find it.
  • The third-party services the site uses (Vercel, Cloudflare, Resend, Google, GitHub and LinkedIn): report those to them.
  • The retired implementation once published under the Nauthera name, before nauthera-server.
  • Findings without a security impact: a missing header or best practice with no attack that uses it, a version number, or a scanner's report on its own.
  • Denial of service, social engineering and physical attacks.

What to include

  • What is affected: the URL, or the release candidate's tag, image digest or commit.
  • What an attacker can do with it, and what they need first.
  • Steps to reproduce it, or a proof of concept.
  • Whether you'd like to be credited, and under what name.

Leave out live secrets, other people's personal data and production credentials.

What we ask you not to do

  • Don't access, change or delete data that isn't yours. If you reach some, stop, keep no copy, and tell us what you saw.
  • Don't degrade the site for others: no load tests and no high-volume scanning.
  • Don't sign up with addresses that aren't yours, and don't contact our team or other people as part of a test.
  • Keep the details private until a fix is released or we have agreed on a date with you.

Safe harbor

If you make a good-faith effort to follow this page, we consider your research authorized. Nauthera GmbH will not take legal action against you or report you to the authorities for it, and if someone else does, we will make it known that you acted under this policy. This covers only systems in scope and only our own claims: we can't authorize testing of services we don't run. If you're not sure whether something is allowed, ask us first.

What to expect from us

  • Within 5 working days, a reply that confirms we have your report.
  • Within 15 working days, whether we could reproduce it and how serious we think it is.
  • Until it is fixed, an update at least every 30 days.
  • A disclosure date agreed with you. We aim to release a fix within 90 days of your report, sooner for severe issues.
  • Credit, once a fix has shipped, if you want to be named. There is no bug bounty: we don't pay for reports.

The product's own policy

nauthera-server's docs/SECURITY.md asks reporters to email a maintainer. A policy of its own with a contact and timelines, and a security.txt that each deployment can serve, are tracked in nauthera/nauthera-server#1531. Until they exist, this page covers the product as well. For running Nauthera securely, see Hardening in the docs.

Machine-readable: /.well-known/security.txt (RFC 9116).