Skip to content

Security

Reporting

Report suspected vulnerabilities privately to contact@simplifyauth.com. Please include reproduction steps and the affected version. You will get an acknowledgment within 72 hours. Please do not open public issues for unverified vulnerabilities.

Architecture guarantees (enforced by the test suite)

  • No network egress from the verification engine. The stdio-only verification and analysis engine makes no network calls, sends no telemetry, and performs no update checks — your rule content, file paths, JARs, DTD, and export never leave your machine. Network egress is confined to one auditable module, the license client: for Individual licenses it contacts the license server for trial start, activation, and a periodic (about monthly; 30-day leases) lease renewal, transmitting only the licensee email (at signup/deactivation), the license identifier, salted device-identifier hashes, and — at trial start and activation only — the accepted EULA version and the local timestamp of that acceptance — never rule content or IIQ data. Enterprise (root-signed) licenses verify fully offline (Ed25519 signature, local file) and contact nothing. Every statement here is observable at runtime with a process or network monitor; enterprise customers can additionally arrange source review under NDA.
  • No code execution of analyzed content. BeanShell is parsed with bsh.Parser only — never interpreted/executed; a permanent regression test pins this. SailPoint classes load with initialize=False for reflection.
  • Nothing of SailPoint's ships here. You point the server at your own licensed identityiq.jar, DTD, and (optionally) export; the repository and wheel contain no SailPoint artifacts or prose (tripwire tests enforce the prose boundary).
  • Your data stays local. The optional export is read locally for reference resolution; at most three same-class object-name suggestions can appear in a response, and IIQ_DISABLE_CATALOG_SUGGESTIONS=true removes those.

Supported versions

The latest minor release receives fixes. Commercial licensees receive all releases for their term; security fixes are prioritized for the current release line.