SecretSpace keeps passwords, so security reports are welcome and taken seriously.
Please do not open a public issue. Report it privately through GitHub: the repository's Security tab -> Report a vulnerability.
Include what you found, the version (Settings -> About, or the installer name), and the steps to reproduce it. You will get an answer within a week. Please give a reasonable time for a fix before you publish anything.
| Version | Supported |
|---|---|
| Latest 2.x release | Yes |
| 3.0 pre-releases (alpha) | Best effort; they are test versions |
| Older releases | No; please update first |
The client in this repository: vault encryption, the master password, Secret Key and recovery phrase handling, the clipboard, the installer and the sync client. Server issues go to the SecretSpace-Server-Windows or SecretSpace-Server-Linux repository, the same way.