We provide security updates only for the latest version:
| Version | Supported |
|---|---|
| Current Version of v2.x | ✅ |
Do NOT report security vulnerabilities through public GitHub issues.
Use one of these private channels:
- Go to the Security tab
- Click "Report a vulnerability"
- Fill out the advisory form
This creates a private discussion visible only to maintainers.
Realistic commitments we can actually meet:
- Initial response: Within 48 hours
- Status update: Within 7 days
- Resolution target: Within 90 days (varies by severity)
| Severity | Response Target | Patch Target |
|---|---|---|
| Critical | 24 hours | 7 days |
| High | 48 hours | 14 days |
| Medium | 1 week | 30 days |
| Low | 2 weeks | 90 days |
Note: These are targets, not guarantees. Complex issues may take longer.
- Credit: Security reporters are credited in release notes and advisories (unless they prefer anonymity)
This project employs:
- SAST: [CodeQL] static analysis and .NET build results
- Decompression Bomb Protection - for both gzip and uncompressed formats
- HTTP Block Protection - Can be changed by settings.json
- Hostlist Size Protection - Can be changed by settings.json
- Sanitizes Generated File Names
- Path Traversal and Symlink Blocking
- Invalid Local Path Rejection
- Atomic File Handling - The combined list only gets updated when there is a update available and will be updated via atomic file replacement.