If you find a security issue, open a GitHub issue but mark it confidential if GitHub allows, or email the maintainer. Do not post it publicly until we've had a chance to fix it.

sortie copies binaries and runs commands on remote servers over SSH. That means:

• SSH keys: sortie reads your private key to log into servers. It never sends the key itself, just uses it locally to authenticate. The key stays on your machine.
• Remote command execution: sortie runs shell commands (systemctl, journalctl, mv, etc.) and uploads your binary via SCP. Whatever the SSH user can do, sortie can do.
• Binary integrity: we don't sign or checksum the binaries you deploy. The hash stored in deploy records is for tracking, not verification. If someone can MITM your SSH connection, they can replace the binary.
• Secrets in config: sortie reads environment variables from your sortie.toml and writes them into systemd unit files. Keep your config file locked down. Don't commit secrets to git.
• Health checks: sortie connects to your app's HTTP endpoint after deploy. It's a plain TCP/HTTP call. No auth is sent.

• Use ed25519 keys (not RSA) and protect them with a passphrase
• Deploy from a dedicated CI machine, not your laptop
• Keep sortie.toml out of version control or use a .env pattern
• Use firewall rules so only your deploy machine can SSH into production
• Regularly rotate deployment keys
• Pin the sortie version you use in CI (avoid latest)

We support the latest release. Older versions don't get backports. If you need something specific, open an issue.