Security is taken very seriously inside SWUpdate. If you think you have found a security vulnerability, please read the next sections and follow the instructions to report your finding.

You can report a vulnerability via Github or (preferably) via e-mail at security@nabladev.com We try to respond to security issues in a timely manner.

Please provide a detailed description of the issue, the steps to reproduce it, the affected version(s) and, if already available, a proposal for a fix.

Include as much of the following information as possible to help us better understand the nature and scope of the potential issue:

• Type of issue (e.g. buffer overflow, privilege escalation, etc.)
• Full paths of source file(s) related to the issue
• The location of the affected source code (tag/branch/commit or direct URL)
• Any special configuration required to reproduce the issue
• The distro version affected
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit the issue

This information will help us triage your report more quickly.

If for some reason you do not receive a response, please follow up via email to ensure we received your original message. If the issue is confirmed as a vulnerability, we will publish an advisory (e.g. on GitHub) and give credits for your report if desired.