Please do not report security vulnerabilities through public issues, pull requests or discussions.
Use GitHub's private reporting instead. On the affected repository, go to the Security tab and choose Report a vulnerability. This opens a private channel visible only to the maintainer, and lets us coordinate a fix before any details become public.
If private reporting is unavailable on that repository, email matt_parker@outlook.com
with SECURITY in the subject line.
The more of this you can provide, the faster it can be fixed:
- The repository and version, tag or commit affected
- The type of issue (for example: path traversal, command injection, credential exposure)
- Step-by-step instructions to reproduce it
- Proof-of-concept code, if you have it
- The impact — what an attacker gains, and what access they need to start with
- Any suggested mitigation
| Stage | Target |
|---|---|
| Acknowledgement of your report | Within 7 days |
| Initial assessment and severity | Within 14 days |
| Fix released, or a plan with dates | Within 90 days |
These are targets from a solo maintainer working in their own time, not a contractual service-level agreement. If a report is going to take longer, you will be told rather than left waiting.
You will be credited in the release notes for the fix unless you prefer to remain anonymous.
Unless a repository states otherwise, only the latest release receives security fixes. Older tags are kept for reference and are not patched.
In scope:
- Code in the repository itself
- Published release artifacts and their build process
- Dependencies where the fix is a version bump within this project
Out of scope:
- Vulnerabilities in third-party dependencies that must be fixed upstream — please report those to the upstream project, though a heads-up here is appreciated
- Findings from automated scanners with no demonstrated exploit path
- Issues requiring physical access to an already-compromised machine
- Missing code signatures on release artifacts. These projects ship unsigned by design; this is a documented decision, not an oversight
Good-faith security research on these projects is welcome. Provided you avoid privacy violations, data destruction and service disruption, and give reasonable time for a fix before public disclosure, no action will be sought against you.