Security and trust at Lithnet
We know that our software runs in the most sensitive parts of your environment, and we take that responsibility seriously. We sign every package, we rigorously test every release, and we design our products so that your data stays in your environment.
Company facts
Check our signed code
We make it easy for you to be sure that the code you run in your environment comes from us.
- Windows installers are signed with Lithnet Pty Ltd's Extended Validation code-signing certificate from DigiCert and carry a trusted timestamp.
- The Password Protection filter is co-signed by Microsoft, so it loads on domain controllers that have LSA protection turned on.
- macOS packages are signed by Lithnet Pty Ltd (Apple Team ID 5DK86QQXK3) and notarized by Apple.
- Linux RPM and DEB packages, and the APT and YUM repositories, are signed with our GPG keys.
- Each release has a signed release manifest that lists the SHA-256 hash of every package. Linux tar.gz archives are not signed directly, so please verify them against their SHA-256 hash.
- Every download page shows the SHA-256 hash of each package.
| Key | Address | Fingerprint |
|---|---|---|
| GPG key for DEB packages and APT | https://packages.lithnet.io/keys/lithnet.asc | 9349 61BD 5387 4339 F096 7F33 ADED D2EE FBF6 C33B |
| GPG key for RPM packages and YUM | https://packages.lithnet.io/keys/lithnet-rpm.asc | A051 A97D 6C1D 6A42 7A73 FDBF AE83 CF14 6CDD 84AD |
Every release is tested before it reaches you
Before we sign and publish a release, it goes through a dedicated validation pipeline that runs security tests, unit tests and end-to-end tests against it.
We trust our products with our own security too. They run in our own environment and protect Lithnet the same way they protect you.
Independent testing
CyberCX penetration tests every major version of Access Manager. We give their testers our source code so that they can look for flaws in the code as well as attack the running product.
Advances in AI are changing how software is tested, and we are building more advanced testing into our products. With access to advanced models such as Mythos, we can scan for complex vulnerabilities and give you a high level of assurance that you are getting a quality product.
Report a vulnerability
Please send reports to security@lithnet.io. Our contact details are also published in /.well-known/security.txt.
You can report vulnerabilities in Lithnet Access Manager, Lithnet Password Protection for Active Directory, our other open-source tools and lithnet.io. Please tell us what you found, which product and version it affects, and how to reproduce it. We will confirm that we have received your report and let you know what action we decide to take. Please give us a reasonable time to release a fix before you share the details publicly.
We value the work of security researchers and firmly believe that working together makes everyone safer. We believe in the responsible disclosure of security issues and commit to working closely with every researcher who follows these steps.
Your data stays in your environment
Your data is yours. Our privacy policy outlines how we handle your data, and we never sell it to third parties. We design our products to ensure that your data stays inside your environment.
- With Password Protection, passwords never leave the domain controller. The filter does not need internet access.
- Access Manager runs on your own Windows Server and does not depend on a Lithnet cloud service. Your passwords and BitLocker recovery keys never leave your environment.
Talk to the team behind the products
If you have a question about any of our products, or you'd like help choosing the right one for your organization, get in touch and we'll be happy to help.