Reporting security issues

Omnipacto manages contracts, documents and names: data where a mistake gets expensive. If you have found a vulnerability, please report it before you talk about it. I am grateful for every report, including the ones that turn out to be false alarms.

Contact

Email sicherheit@omnipacto.de. If you prefer, I will reply encrypted; just say so.

What helps me

• The affected version (shown at the bottom left of the app, for example v0.4.1).
• How to reproduce the problem: step by step, sample data welcome.
• What it makes possible: reading data, changing data, seeing other households, reaching servers.
• Whether you tested in your own installation or in someone else's.

What I promise

• I will confirm receipt of your report promptly.
• I will tell you promptly whether I could reproduce the problem and how I rate it.
• I will tell you when a version with the fix has been released.
• If you wish, I will credit you in the release notes, or expressly not.

How long a version receives updates

For licences bought on or after 7 November 2026: security and bug fixes for at least three years from purchase; new features at no extra charge for as long as Omnipacto is developed (terms, section 4). Your statutory rights for defects in digital products remain unaffected. For older licences: unlimited, for as long as Omnipacto is developed, with no maintenance contract and no pressure to move to a new major version.

Should development end, I will announce it at least six months in advance on this page; until then security vulnerabilities continue to be fixed. Such a notice would appear at the very top here. As long as it is absent, the previous paragraph applies: this page is where you can check.

What I ask of you

• Test in an installation of your own. Omnipacto is self-hosted; you may use the demo at demo.omnipacto.de for this.
• No attacks that disrupt operation (load attacks, mass requests) and no access to other people's data. If you see someone else's data by accident, stop and tell me.
• Give me the chance to fix the problem before you publish it.

What Omnipacto does itself

• Every published version is checked against a test catalogue: role and household boundaries, address checks for connected services, upload hardening, sessions and access, backup and restore.
• The app checks for new versions at most once a day, so that security updates arrive. How exactly this works and how to switch it off is described in the privacy policy.
• Every version comes with a bill of materials of the third-party components used (SBOM, CycloneDX format) and the checksum of the image. This lets you see what a version contains and check that the downloaded image is the one I published.
• Every image is signed (cosign). The checksum alone only says that nothing has changed since, the signature says that it comes from me. You can check it with the public key at omnipacto.de/cosign.pub:

  cosign verify --key https://omnipacto.de/cosign.pub \
    ghcr.io/maaatze/omnipacto:<version>