The v0.4.x compatibility line is maintained for the matching PastureStack Server release. New authentication-provider combinations remain subject to administrator testing before activation.

• RSA private keys, configuration-encryption keys, provider secrets, API credentials, tokens, cookies, OpenID Connect authorization codes, and SAML assertions are sensitive.
• Insecure identity-provider metadata TLS is a compatibility escape hatch and must remain disabled by default.
• Redirect targets must stay within the configured allowlist and control-platform API host.
• OpenID Connect discovery, authorization, token, UserInfo, and signing-key endpoints require HTTPS except for explicit loopback tests. Custom certificate authorities extend the system trust store; they never disable certificate verification.
• OpenID Connect ID tokens accept only supported asymmetric signatures and require issuer, audience, expiry, issued-at, and nonce validation. UserInfo must return the same subject as the ID token.
• A staged provider test must not expose the upstream access token or create a browser session. Activation uses a fresh authorization code and the normal platform token endpoint.
• A staged sign-in identity proof is signed, short-lived, audience-bound, and replay-protected by the control platform. It carries the exact provider and immutable external identifier used for an explicit account-link decision; usernames and email addresses are display data, not matching keys.
• Do not commit keys, credentials, tokens, encrypted production settings, identity data, or live assertions.

• The reviewed vendor tree is generated by scripts/vendor. It retains the upstream crewjam/saml license and runtime source but removes that module's legacy go-fuzz harness because the harness is not used by this service and embeds a fixed test private key.
• The Dapper image is an ephemeral build tool, not a runtime service. Its final user is unprivileged, it does not bundle a Docker client or mount the host Docker socket, and release jobs run it with the caller's numeric UID and GID.
• The Dapper base image uses an immutable Ubuntu 26.04 digest. The official Ubuntu snapshot and every directly installed APT package are exact values in ubuntu-apt.lock; the validation suite compares those values with the packages installed in the image.
• security/openvex.json records the reviewed GO-2026-5932 applicability decision. That advisory is limited to golang.org/x/crypto/openpgp; this service imports only md4 and ripemd160. The VEX decision must be re-reviewed whenever the x/crypto version or imported package set changes.
• security/dapper.openvex.json is limited to kernel advisories attributed to the linux-libc-dev user-space header package in the ephemeral builder. The gate requires an exact CVE and PURL match, rejects any installed kernel image or module package, and verifies that the shipped archive contains only a statically linked, CGO-disabled Go binary. Any changed finding invalidates the VEX set and closes the gate.

Report suspected vulnerabilities through this repository's private security advisory channel. Do not include credentials, tokens, or personal identity data in a public issue.