Report confidentially

Report vulnerabilities to joshua.baums@informatik-baums.de with subject “SSH Keys Security”. Include app version, affected feature, prerequisites and reproducible steps without real private keys. Agree on a suitable channel before sending sensitive details; ordinary email is not end-to-end encrypted throughout.

Protection and limits

Secure system randomness is always required. Drawing does not guarantee a specific number of additional entropy bits. Password-protected PKCS#8/PBES2 export protects confidentiality; AES-CBC does not authenticate a file. Verify the public fingerprint in the destination tool. A compromised or unlocked device and incorrectly configured destination systems remain risks.

Suspected exposure

Stop using affected keys. Through independent administrator access, register replacement keys and remove affected public keys from authorized_keys. Preserve evidence without secrets. Informatik Baums investigates app issues and communicates remedies for confirmed product risks; necessary authority notifications are assessed separately.