Skip to main content

Reporting vulnerabilities

Do not disclose a suspected Authenik8 vulnerability in a public issue, discussion, pull request, chat room, or social media post.

Report privately​

Use the repository's private vulnerability report form. If GitHub private reporting is unavailable, email authenik8@gmail.com with the subject Authenik8 security report.

Keep technical details private until a maintainer confirms that coordinated disclosure is safe.

Prepare a useful report​

Include:

  • The affected component: CLI, generated template, or authenik8-core
  • CLI and engine versions, preset, runtime, package manager, and operating system
  • The impact, attack prerequisites, and affected versions
  • Minimal reproduction steps in a disposable local environment
  • Stable Doctor diagnostic IDs when relevant
  • A safe proof of concept that does not target real users or production systems
  • Any temporary mitigation you identified

Never include real credentials, private signing JWKs, access or refresh tokens, cookies, personal data, or production database contents. Use clearly marked test values.

Attach Doctor context safely​

When the issue involves generated configuration or runtime behavior, generate a sanitized support report:

npx create-authenik8-app@latest doctor --report

Doctor writes .authenik8/reports/doctor-<timestamp>.json. Review the file before attaching it. The report provides versioned diagnostic context and redacts known secret forms, but it does not replace a clear vulnerability description or reproduction steps.

What happens next​

  1. Receipt is acknowledged within 72 hours.
  2. Severity and scope are triaged within 7 business days.
  3. Maintainers reproduce the issue and agree on safe disclosure timing.
  4. A fix is developed and tested without publishing exploit details.
  5. The remediation is released and disclosure is coordinated, normally within 90 days when practical.
  6. Reporter credit is provided when requested and safe.

Updates are provided at least every 7 to 14 days while an accepted report remains unresolved.

Scope and safe harbor​

The CLI, generated templates, Authenik8 Identity Engine integration, and unique risks caused by Authenik8's use of a dependency are in scope. Custom application code and unrelated third-party dependency reports are outside this policy.

Good-faith research is authorized when it uses the minimum access needed, avoids privacy violations and service disruption, stops after encountering sensitive data, and follows private coordinated disclosure. If you are unsure whether planned research is covered, contact the maintainers privately before testing.