Please report security problems privately through GitHub's security advisories: github.com/cB-Sigma/iotsec/security/advisories/new. Do not open a public issue, pull request or discussion for a suspected vulnerability.

A useful report says which type or function is affected, the version or commit, what you expected and what happened, and how to reproduce it (a test or a short program is ideal).

This module is mostly interfaces; the security services behind them are provided by the application. Reports are in scope when the problem is in the module itself:

• A seam whose shape forces or invites unsafe use, for example one that cannot carry the information a library needs to refuse something, or whose documented nil behaviour is less safe than it says.
• Unsafe defaults in the little code the module does contain: StdTLS, ServerNameFor, TLSListener, SetKeepalive and the function adapters such as AuditFunc and DialerFunc.
• Incorrect results from that code, such as checking a server certificate against the wrong name.
• Value types whose documented meaning would lead an implementation to an unsafe decision, for example the validity fields of AccessToken or the scope of a RoleGrant.

• Implementations of the interfaces in applications or other libraries; please report those to their projects.
• Problems in Go's standard library (crypto/tls, crypto/x509); please report those to the Go project.

Only the latest v0.x release receives fixes. There are no long-term support branches before v1.

There is no bug bounty. We aim to acknowledge a report within a few working days, to agree on the facts with you, and to publish a fix and an advisory as soon as one is ready. We will credit you in the advisory unless you ask us not to. Please give us a reasonable time to fix the problem before you disclose it.