Contributing¶

Thank you for your interest in Krywerk! Bug reports, suggestions for improvement, translations, documentation and code are welcome.

Before you start¶

Never report security vulnerabilities as an issue – follow the security policy below instead.
For larger changes, open an issue first and agree on the approach.
The Code of Conduct applies.

Development environment¶

Prerequisites and building: README.md (German). Then, once:

pre-commit install          # checks rustfmt, clippy, YAML/TOML/JSON and private keys before every commit
make test                   # unit and integration tests
make lint                   # rustfmt, clippy -D warnings, cargo deny

End-to-end tests per platform: crates/README.md (German).

Rules for code¶

No secret data in logs, error messages or tests: never output passwords, key files, key material, file contents or plaintext file names. Tests use throwaway keys only.
No home-made cryptography. Only vetted libraries (RustCrypto, ring); new algorithms must be justified in Security.
Clean room: do not take any code from Boxcryptor, Cryptomator or Cryptomator Hub. Compatibility comes solely from the descriptions in SPEC.md and docs/ (see there for how they were created).
Style: cargo fmt (see rustfmt.toml), no Clippy warnings, comments and UI texts in German, identifiers in code in English.
Every change comes with a test; bug fixes with a test that demonstrates the bug.
Record visible changes in CHANGELOG.md under “Unreleased”.

Commits and pull requests¶

Small, self-contained commits with a meaningful message (first line ≤ 72 characters).
Developer Certificate of Origin (DCO): with git commit -s you confirm that you are entitled to submit the contribution under the project's license (developercertificate.org). Every commit needs the line Signed-off-by: Name <email>.
Contributions are licensed under the license of the respective part: GPL-3.0-or-later, Krywerk Server AGPL-3.0-or-later.
CI (formatting, Clippy, tests on Linux/Windows/macOS, licenses, secrets) must pass.

Translations¶

The user interface is bilingual (German, English). Texts live in crates/kw-app/ui/i18n/ (app) and crates/kw-server/src/web/i18n/ (web administration); the documentation lives in docs/ – German pages as <name>.md, English pages alongside as <name>.en.md.

Security¶

Krywerk protects confidential data. We take reports of vulnerabilities seriously and thank everyone who reports them responsibly.

Reporting a vulnerability¶

Please do not use public issues, discussions or pull requests for security vulnerabilities.

Preferred: via GitHub “Report a vulnerability” in the Security tab of this repository (private report, visible only to the maintainers).
Alternatively by email to security@krywerk.eu.

Helpful information: affected component and version (krywerk-server --version, “About Krywerk”), operating system, steps to reproduce, expected and actual behavior and – if available – a proof of concept. Please do not send real data, passwords or keys.

What we commit to¶

Acknowledgment of receipt within 3 business days.
Initial assessment (severity, affected versions) within 10 business days.
Fix for critical vulnerabilities as quickly as possible, target 30 days; we keep you informed.
Coordinated disclosure: advisory with CVE (if applicable) and credit to the reporter, if desired. Please give us time until a fix is published, at most 90 days, before you publish details.

We will not pursue anyone who acts in good faith according to this policy: do not access or modify third-party data, do not disrupt services, and test only as far as necessary to demonstrate the issue.

Supported versions¶

Version	Security fixes
latest 0.x	yes
older	no – please upgrade

Scope¶

The desktop app, command-line programs, libraries and Krywerk Server in this repository. Not in scope are vulnerabilities in WinFsp, FUSE-T, libfuse, the identity provider (Keycloak, Entra ID) or Cryptomator Hub – please report those directly to the respective project.

Security model, algorithms and known limitations: Security.