We release patches for security vulnerabilities for the following versions:

We take security vulnerabilities seriously. If you discover a security issue, please follow these steps:

Please do not open a GitHub issue for security vulnerabilities as it could expose the vulnerability before it's fixed.

Send an email to: siyam.ts@gmail.com

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: 1-7 days
  • High: 7-14 days
  • Medium: 14-30 days
  • Low: 30+ days

1. We confirm the vulnerability
2. We develop and test a fix
3. We release a security patch
4. We publish a security advisory
5. Public disclosure after fix is available

Never hardcode passwords:

# ❌ BAD
python3 migrator.py --export --password mypassword

# ✅ GOOD
export REDIS_PASSWORD=mypassword
python3 migrator.py --export

Always enable TLS when connecting to production Redis:

python3 migrator.py --export \
  --host prod-redis.example.com \
  --ssl \
  --ssl-ca-certs /path/to/ca.pem \
  --password "$REDIS_PASSWORD"

Snapshot files contain your Redis data in plain text (hex-encoded):

# Set restrictive permissions
chmod 600 snap/*.db

# Encrypt snapshots for storage
gpg --symmetric --cipher-algo AES256 snap/snapshot_*.db

# Delete unencrypted snapshots
shred -u snap/snapshot_*.db

Never test on production databases:

# Use db 1 for testing, db 0 for production
python3 migrator.py --import --db 1 --dry-run

Log files may contain sensitive information:

# Restrict log access
chmod 600 logs/*.log

# Clean logs after debugging
rm -rf logs/*.log

CRITICAL: Import executes FLUSHDB which deletes all data:

# Always dry-run first
python3 migrator.py --import --dry-run

# Backup target before import
redis-cli SAVE
cp /var/lib/redis/dump.rdb /backup/dump.rdb.backup

# Use SSH tunnel for remote Redis
ssh -L 6379:localhost:6379 user@redis-server

# Then connect to localhost
python3 migrator.py --export --host localhost --port 6379

Create a Redis user with minimal permissions:

# Redis 6+ ACL
redis-cli ACL SETUSER migrator on >password ~* +dump +restore +scan +dbsize +ping

All user inputs are validated:

• Host/port are validated before connection
• Snapshot files are checked for existence and readability
• JSON lines are validated before processing

Keep dependencies updated:

# Check for vulnerabilities
pip install safety
safety check

# Update dependencies
pip install --upgrade redis tqdm

All changes require:

• Code review by maintainer
• Security consideration in PR description
• No hardcoded credentials or secrets

Never commit:

• Passwords or API keys
• TLS certificates or private keys
• Snapshot files with real data
• Log files

Add to .gitignore:

*.pem
*.key
*.crt
*.cert
snap/*.db
logs/*.log
.env

Issue: Import operation executes FLUSHDB, deleting all existing data.

Mitigation:

• Clear warning in console output: ⚠️ Clearing existing Redis data before import (FLUSHDB)
• Documentation emphasizes backup requirement
• Dry-run mode available for testing

User Responsibility: Always backup before import.

Issue: Snapshot files contain unencrypted Redis data in hex-encoded format.

Mitigation:

• Documentation recommends encryption
• .gitignore excludes snapshot files
• File permissions recommendations provided

User Responsibility: Encrypt snapshots for storage/transfer.

Issue: Passwords in command-line arguments may appear in process listings.

Mitigation:

• Environment variable support (REDIS_PASSWORD)
• Documentation recommends env vars over CLI args

User Responsibility: Use environment variables for passwords.

Issue: Unencrypted connections vulnerable to interception.

Mitigation:

• TLS support with certificate validation
• Documentation emphasizes TLS for production

User Responsibility: Enable TLS for production use.

Issue: Large datasets could consume excessive memory.

Mitigation:

• Streaming approach (not loading all data into memory)
• Configurable batch sizes
• Socket timeouts to prevent hanging

User Responsibility: Monitor resource usage with large datasets.

Issue: Logs may contain sensitive data in debug mode.

Mitigation:

• Logs stored in logs/ directory (gitignored)
• Only DEBUG level logs detailed key/value data
• INFO level minimizes sensitive data

User Responsibility: Secure log files, delete after debugging.

No vulnerabilities have been reported to date.

We thank the security researchers who help keep redis-snapper secure:

• (None yet - be the first!)

For security concerns: siyam.ts@gmail.com

For general questions: GitHub Issues

Last Updated: 2026-01-13