Security

Report a vulnerability

If you find a security problem in noah, shepherd, the updater or this site, report it privately through GitHub's private vulnerability reporting on shep95/noah (Security → Report a vulnerability). If that is not available to you, message @house_ofasher or a moderator in the discord and ask for a private channel. Please do not post details publicly.

A useful report says what is affected, the version, the steps to reproduce it, and what an attacker gains.

Act in good faith: do not access other people's data, do not degrade the site or its downloads for anyone else, and give us reasonable time to ship a fix before you disclose.

How releases are verified

Installers are served only from this site, over HTTPS. Each one has a SHA-256 listed on the download page and published beside it as /downloads/<file>.sha256. Check yours with Get-FileHash on Windows or sha256sum on Linux.

noah updates itself from /downloads/latest.json, a manifest that names each installer with its address and SHA-256. The manifest is signed with noah's ed25519 release key, which this site does not hold. noah checks the signature against the public key built into the app and refuses the update if it does not match, then checks the downloaded installer against its SHA-256 before installing it. Whoever controls this website alone cannot ship an update.

The signature covers this text, with the asset lines sorted: noah-release\n<build>\n<version>\n<asset> <url> <sha256>\n…

Release public key (ed25519, hex): 50e21800e89b09f431a54249efdb39ef770563b87734f56142a326e2c536f5e2

The installers are not code-signed with an operating system certificate yet, so Windows SmartScreen does not recognise them. The SHA-256 is how you confirm a download by hand until they are.

This site

The site has no accounts, no forms and no third-party scripts. It is served only over HTTPS with a strict content security policy, and it cannot be framed by other sites. Our security.txt points here.