Security

Security and vulnerability reporting

If you have found a security problem in Torwarden, please tell us. This page says how, and what happens next.

Reporting

Email security@torwarden.com. Include enough to reproduce the issue — a version, the steps, and what you saw. If you would rather not put details in email, say so and we will agree another channel first.

Please do not open a public issue for a security problem, and please do not test against the public demo in a way that would affect other visitors.

What to expect

The commitments below are ones that can actually be kept rather than ones that sound reassuring:

• Acknowledgement within 3 business days, confirming we have it and who is looking at it.
• An assessment within 10 business days: whether we agree it is a vulnerability, how severe we think it is, and roughly when a fix will ship.
• A fix in a normal release, with the issue described in the release notes.
• Credit in those notes if you want it, and none if you would rather not.

We ask for 90 days before public disclosure, and will usually be faster. If we go quiet or you disagree with our assessment, tell us before publishing rather than after — we would rather fix it than argue about it.

In scope

• The Torwarden server and agent, current release.
• The installers published at releases.torwarden.com.
• This website.

Out of scope

• Denial of service, volumetric testing, and anything that degrades the demo for other people.
• Social engineering, physical access, and attacks on our payment provider or DNS host — report those to them.
• Findings that require an attacker who is already an administrator on the monitored host, or already an administrator in Torwarden.
• Missing hardening headers with no demonstrated impact.

What we do not offer

There is no bug bounty and no payment. Saying so plainly is fairer than leaving it ambiguous.

How the product is built

Useful context if you are assessing it:

• Your metrics stay on your infrastructure. The server holds them in SQLite files in its own data directory and sends them nowhere. See privacy for the complete list of what does leave.
• Passwords are hashed with Argon2id, and sessions are per-device and revocable from the profile page.
• Stored secrets are encrypted — TLS private keys and notification channel credentials — with a key file the operator controls.
• Every route is behind a role check, verified by a test that scans the router for any handler that skipped one.
• Releases are checksummed. The installers verify SHA256SUMS before installing anything, and refuse a mismatch.
• The diagnostic bundle is built to be safe to send: versions, schema state, counts and recent log lines, excluding hostnames, credentials and configured values.