Report a security problem

To report a vulnerability in dx or on our websites, email security@axiomdxlab.com. Please include the dx version (dx version), your operating system and shell, and the steps to reproduce it. Please don't post details publicly before we've had a chance to fix it.

We acknowledge a report within 7 days, and tell you what we plan to do, and roughly when, within 30 days. We don't run a bug bounty. The same contact is published at dxcli.com/.well-known/security.txt.

Release signing

Every dx release is signed, and dx checks the signature before it installs an update. These are the fingerprints of the two keys that may sign a release. They are also on dxcli.com: if the two sites ever disagree, don't install, and write to security@axiomdxlab.com.

To check a release yourself, follow the steps under Verify a release. ssh-keygen prints the fingerprint of the key that signed it, and it must be one of the two above.

A change in this list only ever ships in a release that a key already on it signed, and the release notes say so.