TLDR; Reach out to us through a GitHub Private Vulnerability Report.
Permafrost is an authentication gateway developed by Snowcone-Labs. We take security extremely seriously in our products, and value efforts by security researchers. If you have found a potential security issue, we encourage you to report it. This will improve the security of our users, and your contribution will be highlighted unless requested otherwise. After reporting a vulnerability, we aim to provide a first response within 48 hours. Developing a fix will be prioritized. After discussing the patch with the reporter, we will create a release documenting the security issue. A security advisory will also be published, and reporter credited.
- The latest version of Permafrost
- Publicly deployed instances of Permafrost in production
- Vulnerabilities on other software than Permafrost
- Missing best practices without reasonable path to vulnerability
- Client-Side Desync
- SSL/TLS best practices
- Email server best practices
- Verbose error messages
- Leakage of source code
- Self-XSS
- Phishing
- Social engineering
- Unauthenticated / low impact CSRF