Project Status
Wardex is active and shipping.
This page is maintained by the Wardex team. Unlike SaaS uptime dashboards (which don't apply to a self-hosted product), it tracks what actually matters for operators: release cadence, signing keys, open CVE advisories and supply-chain incidents.
Current
At a glance
Releases
✓ Shipping
Tagged releases published to GitHub with SHA-256 checksums, cosign signatures, SLSA provenance, and notarized macOS archives. Current baseline: v1.0.27.
Open CVEs
0
No open security advisories against Wardex code at this time.
Supply-chain incidents
0
No compromised dependencies, key loss or release-infrastructure incidents.
SBOM
✓ Published
CycloneDX SBOM attached to every tagged release.
The current baseline adds failed-auth request bucketing with persisted lockout continuity, bounded endpoint and lock-label observability, Live Monitor recovery diagnostics, SDK live smoke proof, and docs-freshness trust gates while preserving signed-release preflight checks and evidence freshness metadata.
Trust
Verifying a release
cosign key
ed25519 / published in repo under
deploy/cosign.pubEvery release is signed with the committed public key. Verify with cosign verify-blob.
Checksums
SHA256SUMS per release
signed with cosignDownload the SHA256SUMS file, verify its cosign signature, then verify each binary against it.
SBOM
wardex-<version>.cdx.jsonCycloneDX JSON attached to every release. Scan with grype or trivy sbom.
Agent updates
x-wardex-auth + Ed25519
update counters enforcedAgent release assignments now verify trusted signatures, reject replayed counters and downgrades, and re-check artifact integrity before install.
Security contact
Responsible disclosure
Security reports: please email security@wardex.dev or open a GitHub Security Advisory. We follow coordinated disclosure with a 90-day default window and CVE assignment for confirmed issues.