VDP StandardRFC 9116 Compliant

Security & Vulnerability Disclosure

We maintain an open and proactive relationship with the cybersecurity research community. Discover our security standards and disclosure protocol.

1. Cryptographic Compliance Standards

SecurePass implements cryptographic primitives that adhere strictly to international security standards:

  • RFC 4086: Randomness Requirements for Security. We implement unbiased rejection sampling to guarantee uniform entropy distribution.
  • NIST SP 800-63B: Digital Identity Guidelines. Emphasizing length over arbitrary character substitution rules and abolishing periodic forced rotation.
  • FIPS 140-3: Adherence to verified underlying operating system entropy seeds (Kernel CSPRNG).
  • W3C Web Cryptography API: Sole reliance on crypto.getRandomValues for all randomness operations.

2. Vulnerability Disclosure Policy (VDP)

If you believe you have discovered a cryptographic flaw, implementation bug, or potential vulnerability in our tools or documentation, we encourage you to notify us promptly.

Security Contact: security@lakhandewangan.com
PGP Key Fingerprint: 9A4F 2C88 E17B D302 4819 CC41 F082 E391 7844 91D0

Disclosure Guidelines

  • Please allow reasonable time (at least 30 days) for us to investigate and resolve reported issues before public disclosure.
  • Do not perform denial of service (DoS) attacks or attempt to compromise physical server infrastructure.
  • Provide reproducible proof-of-concept steps to assist our engineering team in confirming the behavior.

3. Zero-Knowledge Auditing

Because our generator code is completely client-side and un-obfuscated, any security researcher can audit the exact algorithms by viewing page source or inspecting scripts in the browser debugger.