UDID Tools processes untrusted configuration-profile responses and sensitive device identifiers. Reports affecting confidentiality, integrity, authenticity, availability, privacy, or the release supply chain are treated seriously.

Only the current production release receives security fixes. Unreleased source on main is supported on a best-effort basis.

Use GitHub Private Vulnerability Reporting. Do not open a public issue, discussion, or pull request before coordinated disclosure.

Include the impact, affected release, realistic attack scenario, and a minimal reproduction using synthetic data. Never send production certificates, private keys, PKCS#12/PFX identities, passphrases, challenge values, result tokens, or unredacted device responses.

We aim to acknowledge a complete report within three business days and provide an initial triage within seven business days. These are best-effort targets, not guarantees.

• Profile responses are bounded before parsing and verified through @udid-tools/core.
• Production profile generation fails closed unless explicit signing material is configured.
• Signing certificates and response trust material are caller-provided; the application does not download certificate chains.
• Result links use authenticated encryption and require no database record.
• Device identifiers, profile bodies, challenge values, and result tokens are excluded from analytics and monitoring.
• Production deploys use the checksum-verified, Sigstore-attested GitHub Release artifact without rebuilding it.

Stateless challenges cannot provide strict single-use replay prevention without persistence. Result links are intentionally durable bearer links: anyone who receives a link can view its decrypted result through the service. Users should share them only with intended recipients.