We take security seriously. If you discover a vulnerability in pin-maze, please report it responsibly.

• GitHub Issues: Open a new issue with the security label.
• Private disclosure: If the issue is sensitive, please do not open a public issue. Instead, reach out via GitHub private vulnerability reporting (if enabled) or contact the maintainer directly.

1. Description — what is the vulnerability?
2. Impact — what can an attacker do?
3. Reproduction — step-by-step instructions.
4. Affected versions — which release/commit.
5. Suggested fix — if you have one.

• Acknowledgment within 48 hours.
• Initial assessment within 7 days.
• Fix or mitigation timeline communicated after assessment.

pin-maze is an obscurity tool, not encryption. Be aware:

• Files are not encrypted — they are only hidden in a deep directory tree.
• Anyone with filesystem access and the PIN can retrieve the file.
• Decoy files provide no cryptographic protection — they only slow down manual snooping.
• Do not use this tool to protect sensitive data without additional encryption (e.g., gpg, age).

For real security, combine pin-maze with encryption:

# Encrypt first, then hide
gpg --symmetric --cipher-algo AES256 secret.txt
python pin_maze.py --base ./vault --file secret.txt.gpg --pin 4660

Security researchers and contributors who responsibly disclose vulnerabilities will be credited here (with permission).

Help us keep pin-maze safe for everyone. 🛡