Security

These are specifications for verifying what agents did, so a flaw in them can let a forged or altered record verify. Examples: a hashing or canonicalisation ambiguity, a verification step that can be bypassed, a vector whose expected result is wrong in a way an attacker could use.

Report a flaw like that privately to security@a3wg.org, not in a public issue. Say which specification and version, and include a trace, key set or document that shows it if you have one.

You will get an acknowledgement within seven days. The fix is made in public once implementers have had a chance to prepare. The report is credited unless you ask otherwise.

A flaw in one implementation, including the reference implementation, is reported to that implementation. For Rashnu, see rashnu.dev.