Konnekt is pre-1.0. Only the latest published release is supported. Fixes land on main and go out in the next release or nightly snapshot; there are no backports to older tags.

Check your version in Settings, then About, and compare it against the releases page.

Please do not open a public issue.

Report it privately through GitHub: Report a vulnerability.

That opens a private thread visible only to the maintainers, where a fix can be worked out before anything is public. You will need a GitHub account, which is the only thing keeping this channel usable rather than full of spam.

Helpful to include, as far as you have it: what an attacker can achieve, the version and platform you saw it on, and the steps to reproduce it. A proof of concept is welcome but not required.

This is a small project. Expect an acknowledgement within a few days rather than within hours, and expect to be asked questions. There is no bounty programme, and there is no embargo policy beyond "let us fix it before you publish it", which is asked as a courtesy rather than demanded.

Konnekt runs locally with the full privileges of the person using it, so "the app can read the user's files" is by design, not a finding. What matters is anything that lets someone other than that person influence what it does. Concretely:

• The self-updater (backend/services/update.go). It downloads a release asset and replaces the running executable. Anything that defeats the checksum verification, redirects the download, or leaves a partially written binary in place is in scope.
• RCON credentials. The password is read out of the server's server.properties and held in memory. Anything that leaks it into a log line, a crash dump, a saved file or an outbound request is in scope.
• Path handling in backups, restores and the config-file editor. These take filenames and relative paths and turn them into real file operations, so a traversal that escapes the server directory is in scope.
• Process launching. JVM arguments and jar paths become a spawned process. An injection that turns configured data into an unintended command is in scope.
• Content fetched from Modrinth, including mod jars and the metadata and markdown rendered alongside them.
• Remote access, once it exists. It is not built yet, so there is nothing to report there today.

• Vulnerabilities in Minecraft itself, in the server jar you chose to run, or in mods and plugins you installed. Report those to whoever maintains them.
• Anything requiring an attacker who already has control of the machine Konnekt is running on.
• The absence of a hardening measure, with no described impact.
• Reports generated by a scanner with no analysis of whether the finding is reachable in this app.