Keyforge is security-sensitive software: it mints the tokens your application trusts. Please report vulnerabilities privately.

Use GitHub's private vulnerability reporting on this repository (Security → Report a vulnerability), or email keyforge.security@zdevzone.com. Please do not open public issues for security problems.

You can expect an acknowledgement within a week. Coordinated disclosure is appreciated; credit is given unless you prefer otherwise.

• The trust model assumes the Ed25519 private key never leaves the server. Anything that could exfiltrate it (path traversal, backup exposure, log leaks) is in scope and high severity.
• The admin surfaces (bearer token, session cookies) and the rate-limited public endpoints are in scope.
• "A user patched the public key out of their own copy of a client app" is out of scope: offline licensing keeps honest customers honest; it is not DRM, and Keyforge does not claim otherwise.

• Serve behind HTTPS (a reverse proxy or your platform's TLS).
• Keep LICENSE_SIGNING_KEY and LICENSE_AUTH_SECRET out of the repo and out of build logs; rotate the admin token if it ever leaks.
• Back up the license database; treat backups as secrets (they contain the ledger and, for the auth database, password hashes).

Installation credentials authenticate device identity; hardware hashes are only trial abuse hints. Keep admin tokens and trusted metering credentials off end-user devices. Product keys and generated private signing keys are encrypted with the external data ring. Archive encryption uses a separate external ring; retain recovery copies and historical ring entries. Key reveal is admin-only, rate limited and audited, with password reauthentication for console sessions. Offline authorization cannot learn revocation until refresh or its signed deadline. The current deployment is one workspace; multi-vendor tenant isolation is not implemented.