A head start comes with a duty

Permiso is a European identity and access management (IAM) platform for companies: it decides who can sign in to which applications, and vouches for each person when they do. It speaks the standard protocols (OpenID Connect and SAML) and handles the parts of running identity that a company needs and a single project doesn’t.

Permiso didn’t start from an empty repository. It began as a fork of Pocket ID, an open-source identity provider built to be simple enough for a single person to understand and self-host.

If it breaks, it’s ours

Forking a mature project buys a running start. It also makes the code ours to answer for. Once a company trusts Permiso with its identity, we can’t point upstream when something breaks. Every line of code is our responsibility, regardless of who wrote it. Before shipping Permiso to any customers, we audited the code we inherited the same way we audit the code we write.

Audit results: CVE-2026-62662

The audit was broader than one bug. We reviewed how the server protects data at rest: the user accounts, credentials, and cryptographic keys sitting in its database. We also went through the OpenID Connect implementation: how sign-ins happen, how tokens are issued, and how they’re checked. Most of what we read held up. One part of token issuance didn’t.

An already-authenticated client could obtain a token marked for a service it had no business acting on, crossing a boundary the server was meant to enforce. We reported it privately to the maintainers and they fixed it. Full details are available in the advisory.

As part of the audit, we were adding test coverage to the inherited OpenID Connect flows. These tests assert the current behavior, and writing them is an opportunity to match that behavior against the spec. In this process, an agent flagged the token-issuance behavior as suspect. While parts of the test-writing were AI-assisted, the strategy was human, and so was the verification. We confirmed the flaw was real, built a working proof of concept, and estimated severity ourselves. Open-source maintainers already lose real hours to unverified, machine-generated reports, and we’d rather not add to the pile.

What we send back

Permiso is a hard fork. We took Pocket ID’s code at a point in its history and went our own way. We added support for SAML, and are working on access requests and reviews, mobile applications, and integrations with HR systems. These are the pieces we will need to grow into an IAM platform capable of backing large organizations.

Shared ancestry still means shared bugs, though, so we keep auditing Pocket ID alongside our own code. Security findings are reported upstream every time. That promise is easy to keep: a security fix helps everyone who runs the software and takes nothing from anyone.

Features are harder to upstream. We have our own vision for this product, and want to build it. This means substantial additions, most of which are difficult to upstream as our codebases have diverged. For now the enterprise layer will stay with us, although I would like to see it open sourced in some form in the future.

We’ve also made a donation to the maintainers through GitHub Sponsors. It’s small for now, but we intend to grow it as Permiso does.

Credit where it’s due

Pocket ID and its maintainers gave us a clean base to build on. It’s open source and freely available. If it fits your needs, use it directly.

That’s the posture we want to hold as we grow: build on solid foundations, credit them openly, and send back what’s shared. We took a head start from someone else’s good work. We’d like to leave that work better than how we found it.