Software security research, and the tools we build for it.
Report a vulnerability · Repositories
| Vulnerability research Finding bugs in software we don't own; disclosing them responsibly. |
Supply chain Provenance and CI hardening, shown on our own releases. |
Tooling Open-source security libraries, released when ready. |
- go-avscan: asks the machine's antivirus about a folder: AMSI, clamd, or a command you name.
- go-keyring: one credential store for a Go desktop app, with a sealed-file fallback inside Flatpak.
- go-codepair: pairs two devices on a LAN with a short typed code.
- Releases are built in CI and carry signed provenance and an SBOM. Verify any of them with
gh attestation verify <file> --owner Totative. - Every commit and tag is signed.
- Public repositories run CodeQL and publish an OpenSSF Scorecard.
- Vulnerability reports come in privately; advisories and CVEs go out through GitHub, with credit to the reporter.
- Bugs we find in other people's software are reported privately first, under our disclosure policy.
Use Report a vulnerability on the repository's Security tab, not a public issue. Scope and what we commit to are in the security policy.
A totative of n is a positive integer up to n that shares no factor with it other than 1. Euler's totient function counts them; RSA is built on it.
