This repository holds engineering knowledge alongside runnable reference projects under projects/. Those projects are teaching material: they are built to be read and run locally, not to be deployed as-is. A vulnerability in a reference project still matters, because people copy reference projects.
Only the main branch is maintained. There are no released artifacts.
Do not open a public issue, and do not send email. A public issue tells everyone about the problem before there is a fix.
Report it through GitHub Security Advisories, which keeps the report private until a fix is ready:
- Open the Security tab of this repository.
- Go to Advisories.
- Click Report a vulnerability.
A useful report says what the flaw is, how to reproduce it, and what an attacker gets out of it. A proof of concept helps more than a description.
This repository is maintained by one person, so treat the timeline accordingly: an acknowledgement within a week, and an honest answer about whether the issue will be fixed, rather than silence. If a fix is accepted, disclosure is coordinated with you.
If a report turns out not to be a vulnerability, you will be told why.
