Security fixes are generally applied to the latest released version of this project. Older versions will likely not receive security updates.
If you discover a potential security vulnerability, please report it privately rather than opening a public GitHub issue.
You can report vulnerabilities using GitHub’s private vulnerability reporting feature under the repository’s Security tab.
- Open the repository on GitHub. (Probably already done!)
- Select the Security tab.
- Under Reporting, select Report a vulnerability.
This cleates a private report visible only to the maintainers and the reporter.
Please include, if possible:
- A description of the vulnerability and its potential impact.
- The affected version(s).
- Steps to reproduce the issue or a proof of concept.
We aim to acknowledge security reports quickly, although response times may vary depending on maintainer availability. Currently "cuthbertLab" comprises one volunteer, not an organization and no longer affiliated with a large organization with such resources
We will investigate reported vulnerabilities and, when appropriate, work toward a fix and coordinated public disclosure.
Please avoid publicly disclosing vulnerability details until we have had a reasonable opportunity to investigate and address the issue.
Thank you for helping keep this project secure.
This project is provided “as is,” without warranties or guarantees of security. While we take security reports seriously, we cannot guarantee that every reported vulnerability will be fixed or that fixes will be provided within a particular timeframe.
See the project’s LICENSE file for the full warranty disclaimer.