Do not report security vulnerabilities in public GitHub Issues.
Use GitHub's private vulnerability reporting for this repository:
- Open a private security advisory
- Or use the repository Security tab → Advisories → Report a vulnerability
If private reporting is unavailable, contact a repository maintainer through GitHub. Do not invent or use an unofficial inbox, and do not post exploit details publicly.
Please include:
- Affected package (
@uplevelhq/adonis-wsand/or@uplevelhq/adonis-ws-client) and version - Reproduction steps or a minimal proof of concept
- Impact (what an attacker can do)
- Environment (Node version, AdonisJS version if relevant, Redis if relevant)
- Suggested mitigation if you know one
Reports involving the following are especially useful:
- Authentication bypass
- Cross-channel data leakage
- Origin / upgrade-security bypass
- Denial of service or resource exhaustion
- Secret leakage
- Redis cross-node isolation failures
| Package | npm status |
|---|---|
@uplevelhq/adonis-ws |
Published on the 1.0 release-candidate line (rc dist-tag). No stable 1.0.0 yet. |
@uplevelhq/adonis-ws-client |
Not yet published (first publication planned on the rc channel). |
Report the exact version you are running (for example 1.0.0-rc.1 or 1.0.0-rc.2). Security support for stable releases will be documented by release line once 1.0.0 ships. This repository does not currently claim long-term support for older versions.
This policy covers the packages in this repository:
@uplevelhq/adonis-ws@uplevelhq/adonis-ws-client
Application-owned code (auth tickets, channel authorization, business rules, the shared-calendar example) is out of scope except where a provider or client defect caused the issue.