Security fixes are applied to the latest release only. Older releases are not patched.

Please report security vulnerabilities privately through GitHub's private vulnerability reporting rather than opening a public issue.

mink reads untrusted input by design: objects, archives and images from any producer. A malformed input that makes mink crash, hang, or read or write out of bounds is a vulnerability and is welcome as a report.

Expect an acknowledgement within a few days. If the report is confirmed we will prepare a fix and coordinate disclosure with you. If it is declined we will explain why.