Google2FA is a cryptographic library used for two-factor authentication, so security reports are taken seriously and prioritized.

Please do not open a public issue or pull request for security vulnerabilities. Instead, report privately via GitHub Security Advisories:

Report a vulnerability

This delivers the report directly to the maintainers and keeps the discussion private until a fix is ready.

If you cannot use GitHub Security Advisories, email acr@antoniocarlosribeiro.com with the subject prefix [google2fa security].

• A description of the vulnerability and its impact
• Steps to reproduce (proof-of-concept code is welcome)
• The affected version(s) — check composer show pragmarx/google2fa
• Any suggested mitigation or fix

You should expect an initial acknowledgement within a few days. After triage:

• If the report is valid, a fix is prepared on a private branch and a coordinated release is planned.
• A CVE will be requested if the issue warrants one.
• You will be credited in the release notes (unless you prefer to remain anonymous).

See the Version Support section in the README for the full lifecycle policy.