Found a hole? Tell us quietly.
doze runs on your machine, asks for an admin password once and fetches signed code. If any of that can be turned against you, we want to hear it before anyone else does. Please don't open a public issue.
Report on GitHub, privately
Only the maintainers see it. We can talk it through, fix it and publish the advisory in the same place.
Report a vulnerability- What you found and what it lets someone do
- How to reproduce it
- The version: the output of
doze version
A tool for your laptop, not a server.
doze runs engines on 127.0.0.1 and gives the AWS services dummy credentials. It is not built to face a network or to run production. The reports that matter most:
- Local privilege escalation, through the admin setup or the network daemon it installs.
- Code execution through config: a doze.hcl or a module that does more than it says.
- The supply chain: anything that gets an unsigned or altered engine or module past doze's checks.
doze AWS and doze Kafka are covered too: report them here and we route it.
Fixes land on the latest minor.
| doze | Security fixes |
|---|---|
| 0.2.x | Supported latest is 0.2.0, [0.2 release date] |
| 0.1.x | No fixes update with brew upgrade doze [confirm policy] |
Pinned engines and modules are separate from doze's version: a fix to a module is a new module release, and a yanked release says which to use instead.
Exactly what doze changes, and how to take it back.
Most of doze runs as you, in ~/.doze. Two things need an admin, and each is one prompt you can read first with --print.
One admin prompt, for .doze names
So a name like gateway.larder.doze (from our example project, Larder) resolves, and on macOS two stacks can both use port 5432. Only doze sets this up: doze AWS and doze Kafka, run on their own, listen on 127.0.0.1 and need no names.
- macOS/etc/resolver/doze
- /Library/LaunchDaemons/dev.doze.netd.plist
- /Library/PrivilegedHelperTools/dev.doze.netd
- Linuxdoze-netd.service (systemd)
- a .doze route for systemd-resolved or dnsmasq
- /etc/sysctl.d/60-doze.conf (ports from 80)
doze dns-setup --uninstallA local certificate authority, only if you ask
Nothing happens until a stack declares domains = ["dev.acme.com"] and you run doze trust. Then doze makes one authority for this machine and trusts it, so https on your own domain works in every browser.
- key~/.doze/ca, mode 0600, never leaves the machine
- trustthe System keychain (macOS), the system store (Linux)
- routeone per declared domain, e.g. /etc/resolver/dev.acme.com
doze trust --remove·New key:doze trust --rotateNo telemetry
No usage stats, no crash reports, no account. That is also why the registry shows no download counts: we don't have them. This website sets no cookies and runs no analytics.
The network, only for what you declared
- Engines and modules your doze.hcl names, from the registry, each checked against its signature before it runs. Pinned and cached means offline.
- Downloads you declare yourself (a
servicewithdownload), checked against the sha256 in doze.lock. - GitHub's releases API, only when you open Settings › About or press Check for Updates. Nothing runs in the background.
From source to your laptop, checked at every hand-off.
An engine you never built yourself still has a trail: who built it, who signed it, and the hash your project expects.
- 1 · BUILD
doze-binaries
Builds each engine from upstream source, per platform. Postgres 14.0 to 18.6, Valkey, MariaDB and the rest.
sha256 per platform - 2 · PACKAGE
doze-modules
Builds the module that runs the engine, for Apple silicon and both Linux architectures, in CI.
postgres-plugin-0.2.4-…tar.gz - 3 · SIGN
The registry
Signs every artifact, and the index over all of them, with one ed25519 key.
index.yaml + signatures - 4 · VERIFY
doze
Checks the index and each file against the key compiled into doze, and each hash, before anything runs.
a mismatch stops the start - 5 · PIN
doze.lock
Pins each engine's and module's version and per-platform hashes. Nothing moves until you upgrade.
commit it; teammates get the same bytes
Published advisories
No advisories for doze, doze AWS, doze Kafka or any module so far. When there is one, it is listed here with the affected releases, the fixed release and the command to move to it, and every affected module release in the registry carries a notice.