JDKCertsTool follows Semantic Versioning. Security fixes are applied to the latest released minor version. Please upgrade to the latest release before reporting an issue.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Instead, report them privately through GitHub's built-in advisory workflow:

• Open a private report via * *Security → Advisories → Report a vulnerability**.

Please include, where applicable:

• A description of the vulnerability and its impact.
• Steps to reproduce (the exact jdkcerts command and environment — OS, JDK versions, output of jdkcerts info).
• Any proof-of-concept, logs, or affected code paths.

You can expect an initial acknowledgement within a few days. Once triaged, we will work on a fix, coordinate a release, and credit you in the advisory unless you prefer to remain anonymous.

JDKCertsTool is a developer tool that manages the JDK truststore (TrustedCertEntry entries in cacerts). It deliberately does not manage application private keys (PrivateKeyEntry) — see the README scope section. Reports about private-key handling are therefore out of scope by design.

Because the tool assumes a development environment, it defaults to the standard changeit truststore password. Using it against hardened production truststores is outside its intended use.

This project enforces dependency locking and offline SHA-256 dependency verification, and runs SonarCloud and CodeQL on every change. Dependabot updates are automatically reconciled with the verification manifest by a dedicated workflow. See Build Security for how these gates work and how to update them.