Security
Identity and Access Management is a critical aspect of cloud security, and as such, security is our top priority when developing and maintaining IAM Zero. If you have any questions about our security program you may email security@commonfate.io.
Secure Design#
The IAM Zero client libraries do not capture or transmit AWS credentials such as session tokens. The IAM Zero service is designed to be run locally on your own development computer or in your own cloud environment. No external connections are required to deploy or run IAM Zero.
Release Verification#
Once binary releases of IAM Zero are created they will be signed with our PGP key. We are currently not yet hosting binary builds but it is possible to build IAM Zero from source code yourself. Once binary builds are available this page will be updated with instructions on how to verify the authenticity of a release.
Vulnerability Reporting#
We deeply appreciate any effort to discover and disclose any security vulnerabilities in IAM Zero. We currently do not operate a public bounty program but individuals may be acknowledged in security notifications as appropriate.
If you would like to report a vulnerability in IAM Zero, please email security@commonfate.io rather than raising an issue on GitHub. We ask that you follow the responsible disclosure model. You may encrypt your message with our PGP key printed below. We take all vulnerability reports seriously and will rapidly respond and verify the vulnerability before taking steps to address it.
Penetration Testing#
Before reaching a stable release of IAM Zero we plan to engage an external third party to conduct an independent security assessment of the application. Once completed this report will be available upon request by emailing security@commonfate.io.
PGP Public Key#
Our PGP public key can be fetched from Keybase with fingerprint 65AB 725B 01E6 5C85 051F 9FD5 5024 78AB E3D8 ED71. A copy of the public key is included below.