Security & Disclosure

How it's built

• End-to-end encryption. Devices talk to each other over WireGuard. Private keys are created on each device and never leave it; we only ever see public keys.
• No traffic through us. The coordination service only tells devices how to find each other. When a direct connection isn't possible, the relay forwards packets it can't decrypt, and only between devices of the same workspace, using short-lived signed tickets.
• Workspaces are isolated. A device only learns about, and can only reach, devices in its own workspace.
• Access rules on every device. Each device enforces your workspace's access controls on what it receives, so a rule holds even if another device misbehaves.
• Controls for admins. Device approval, key expiry, roles, and a tamper-evident audit log of every change.
• Protected operations. Secrets like auth keys and tokens are stored hashed, the dashboard calls our admin API only from the server, and public endpoints are rate-limited.
• API tokens with limits. Tokens are stored as hashes, work only on their own workspace, always expire, and can't reach actions reserved for the dashboard, such as creating tokens or sending logs to a new destination.
• Certificates without key handover. For HTTPS certificates, the device makes its own key and sends only a signing request; the private key never leaves it.
• Backups that are checked. Backups are encrypted with AES-256-GCM, and every copy is read back and decrypted to prove it restores.

Reporting a vulnerability

Email security@getunderpass.com with what you found, how to reproduce it, and what it could let someone do. Please give us a reasonable time to fix it before telling anyone else. We'll:

• Acknowledge your report within 3 business days.
• Keep you updated while we work on a fix, and tell you when it's out.
• Credit you, if you'd like, once it's fixed.

Safe harbor

If you research in good faith and follow these rules, we won't take legal action against you and will treat your work as authorized:

• Use only accounts and workspaces you own or have permission to test.
• Don't access, change or keep other people's data; stop and tell us if you come across any.
• Don't degrade the service for others: no denial-of-service, spam or social engineering of our team or users.
• Don't test physical security or third-party services we use.

In scope

• The dashboard, the coordination service and its APIs, and the relay.
• The Underpass apps for Windows and Linux.
• This website.