Security

Reporting a vulnerability

How to report

If you believe you have found a security vulnerability in Futrou Cloud, Futrou Nasua, Futrou CLI, or any other Futrou component, please let us know right away by opening a private security advisory on GitHub for the affected repository, or by emailing security@futrou.com. You can encrypt your email with our PGP key. These contact details are also published in security.txt.

Please include:

• a clear description of the problem
• exact steps to reproduce the issue
• affected versions of the project
• workarounds or mitigations, if known

We will investigate all legitimate reports and do our best to fix the problem quickly. You should expect an initial response within 3 business days.

Embargo policy

While we are working on a fix, details of the issue must remain private. This keeps users protected until a patch is available. No sneaky leaks to your friends, your neighbor, or even your cat.

If information is shared by mistake, please let us know right away so we can take the proper steps. We’ll tell you as soon as it’s safe to share more details.

GPG - Verifying software

Futrou software binaries and packages are signed with our PGP release key. Verifying the signature confirms that the build comes from Futrou and was not modified in transit. The Futrou install.sh scripts, for Futrou CLI and Futrou Nasua, perform this verification automatically, so you only need the steps below when downloading files manually.

Import the public key

curl -fsSL https://futrou.com/.well-known/pgp-key.txt | gpg --import

Check that the fingerprints printed by GnuPG match the table above:

gpg --fingerprint releases@futrou.com

Verify a download

Download the release file together with its detached signature (the same file name with an .asc extension), then verify it:

gpg --verify nasua-linux-amd64.asc nasua-linux-amd64

A valid file reports Good signature from "Futrou <releases@futrou.com>". If GnuPG reports BAD signature, do not run the file and report it to us.

GnuPG also warns that the key is not certified with a trusted signature. This is expected unless you have signed our key yourself; what matters is that the fingerprint matches the one published on this page.