Security
How to report a vulnerability in any Douklar tool, and who is responsible for what when you run Douklar.
Updated
Report a vulnerability
Report privately. Please do not open a public issue for a suspected vulnerability, and never include secrets, credentials or live payloads.
- Email: douklar@hummatovic.com, for every Douklar tool.
- GitHub: for tools with a public repository, private vulnerability reporting may also be enabled. See each repository's policy: SSM Explorer, Agent Workspace.
Include what is affected, how to reproduce it, and the impact as you see it.
Who is responsible for what
Douklar is self-hosted, so security is shared.
- The maintainer owns secure defaults and the documented behaviour of the software.
- You, the operator, own the deployment: the host, the network, your identity provider, the AWS credentials you give Douklar, the AWS costs of the calls it makes, and lawful use of the data you move.
Never expose a Douklar instance running without sign-in (AUTH_MODE=none) to
a network. That mode exists only for a local, single-user machine.
There is no SLA and no third-party security certification. Douklar is a developer preview.
How Douklar protects your data
The product's safety model, its complete list of writes, and its handling of KMS keys and credentials are on the safety page.