KeenAuth security advisories

We publish a security advisory when a vulnerability we have fixed could cause serious harm, or when customers or third parties need to take action or assess their risk. An advisory is published after the fix is available, within the timeline of our vulnerability disclosure policy.

What an advisory contains

• An identifier in the form ASA-YYYY-NNNN.
• A description, the impact and the action customers should take.
• The affected surface: for the hosted platform, the UTC time window and the regions; for SDKs and tools, the package name, the affected version range and the fixed version.
• A CVSS v4.0 vector and the date of the fix.
• Credits for the people who reported the issue.

CVE identifiers

Vulnerabilities in our open-source client packages (SDKs, CLI, MCP server and OpenTofu provider) receive CVE identifiers through GitHub security advisories. Issues in the hosted platform are published with an ASA- identifier.

Subscribe

Follow the Atom feed https://trust.keenauth.com/advisories.atom in any feed reader. A machine-readable index is available at https://trust.keenauth.com/advisories/index.json.

Software bill of materials and VEX

Every release of an SDK, the CLI, the MCP server and the OpenTofu provider comes with a CycloneDX software bill of materials (SBOM), a signature and build provenance. When a known vulnerability in a component does not affect our product, we state this in an OpenVEX document published with the advisory.

Security support

Each product line receives security updates for at least five years. Fixes are released in the latest major version and upgrading is free of charge. The previous major version receives security fixes for 12 months. Every security update remains available for at least ten years, or for the rest of the support period if that is longer.

Report a vulnerability

Email [email protected] or read our vulnerability disclosure policy. This channel is always open.

Atom feed · Machine-readable index (JSON)

Advisories are published in English, which is the binding language.

No security advisories have been published yet.