Security Policy and Hardening
Found a vulnerability? Please report it privately. The first half of this page explains how; the second records flaws found in released versions and how long their fixes took to reach users.
Security Policy
Please do not open a public issue for a suspected vulnerability. A public proof of concept is also a handy set of instructions for attacking deployments that have not been patched yet.
Use GitHub's private vulnerability reporting:
- Navigate to the repository's Security and quality section on GitHub.
- Click Report a vulnerability.
- Follow the private vulnerability reporting flow.
Please include enough information to reproduce and assess the problem:
- A description of the issue.
- Affected versions, commits, or components.
- Reproduction steps or a proof of concept, as far as possible.
- The impact and any suggested mitigation.
We will:
- Acknowledge reports promptly.
- Assess severity and impact.
- Work on a fix or mitigation.
- Coordinate disclosure responsibly.
Response and remediation time depends on the scope of the issue, maintainer availability, and whether a coordinated upstream release is required.
Hardening
Security problems in released software belong in the public record. The tables below list what was found, what changed, and how long the fix took to reach a release.
- Findings that also affected a dependency were reported upstream and released in coordination with its maintainers.
- Findings confined to Warden Supreme were entirely ours to fix and release.
Primary Advisory Source
GitHub is the primary advisory source and may be updated a few hours before this page.
New findings are added here as they are disclosed. GitHub remains the authoritative source if this page and an advisory briefly disagree during a release.
Warden Supreme 1.1.0
Released on 2026-08-14.
| State | Advisory | Short description | Reported | Assessed | Resolution |
|---|---|---|---|---|---|
| Published | GHSA-6jpm-5g92-cpcg | Rejects duplicate CSR attributes and extensions. Strictly defence-in-depth, as Warden Supreme delegates semantic CSR validation to integrators. | 2026-08-02 | 2026-08-02 | 2026-08-14 |
Warden Supreme 1.0.3
Released on 2026-08-12.
| Advisory | Short description | Reported | Assessed | Patched/released |
|---|---|---|---|---|
| GHSA-4r28-jj7j-g7v8 | Limits and canonicalises attacker-controlled Android application IDs and signer digests, and verifies certificate chains before fully decoding attestation extensions. | 2026-08-05 | 2026-08-07 | 2026-08-12 (1.0.3) |
| GHSA-3chr-q239-rmpp | Replaces full-cache expiry scans with nonce- and expiry-ordered indexes to prevent quadratic CPU denial of service. | 2026-08-05 | 2026-08-07 | 2026-08-12 (1.0.3) |
| GHSA-qv7m-wr3r-hfg3 | Adds payload-size and nesting guards to prevent verifier stack exhaustion during hybrid JSON deserialisation. | 2026-08-05 | 2026-08-07 | 2026-08-12 (1.0.3) |
| GHSA-3qj3-8wvm-fmcp | Bounds nested challenge payload deserialisation to prevent a malicious challenge endpoint from crashing clients. | 2026-08-05 | 2026-08-05 | 2026-08-12 (1.0.3) |
| GHSA-744h-w68v-qfpc | Clarifies the verifier's hardware/software OR semantics so operators do not accidentally weaken their attestation policy. | 2026-08-05 | 2026-08-05 | 2026-08-12 (1.0.3) |
| GHSA-rxrw-2p38-wfmr | Safely returns repeated singleton tags when their values agree and reports conflicting values as failures. | 2026-08-05 | 2026-08-09 | 2026-08-12 (1.0.3) |
| GHSA-2f9g-97q5-f2wr | Includes the App Attest environment in iOS policy selection, preventing sandbox and production policies from being confused. | 2026-08-05 | 2026-08-07 | 2026-08-12 (1.0.3) |
Warden Supreme 1.0.2
Released on 2026-07-15.
| Advisory | Short description | Reported | Assessed | Patched/released |
|---|---|---|---|---|
| GHSA-frpv-cj76-xm4r | Derives the attestation security level from the certificate chain and requires it to match the level claimed by the attestation extension, preventing StrongBox impersonation. | 2026-07-06 | 2026-07-06 | 2026-07-15 (1.0.2) |
Warden Supreme 1.0.1
Released on 2026-06-24. Warden Supreme itself had no published advisory for this release; it updated Signum to the version containing the upstream fix below.
| Advisory | Short description | Reported | Assessed | Patched/released |
|---|---|---|---|---|
| Signum GHSA-hch5-9pjg-jqjh | Updates to Signum 3.24.0, which bounds recursive ASN.1 operations that could otherwise cause denial of service. | 2026-06-22 | 2026-06-24 | 2026-06-24 (1.0.1) |