mirror of
https://github.com/only-cli/oc.git
synced 2026-09-15 10:40:56 +02:00
25 lines
886 B
Markdown
25 lines
886 B
Markdown
|
# Security
|
||
|
|
|
||
|
|
## Reporting a vulnerability
|
||
|
|
|
||
|
|
Report vulnerabilities privately through GitHub: [Security > Report a
|
||
|
|
vulnerability](https://github.com/only-cli/oc/security/advisories/new).
|
||
|
|
Please do not open a public issue for anything exploitable.
|
||
|
|
|
||
|
|
Expect an acknowledgement within a week. Fixes ship as a patch release,
|
||
|
|
and the advisory is published once the fix is out.
|
||
|
|
|
||
|
|
## Scope
|
||
|
|
|
||
|
|
oc fetches untrusted web pages by design, so the interesting bugs are the
|
||
|
|
ones where page content escapes its role as data: rendered text that can
|
||
|
|
alter what an agent executes, URLs that reach private or internal hosts
|
||
|
|
despite the SSRF guard, or a crafted page that breaks the distiller. Bugs
|
||
|
|
in the experiments/ directory are out of scope; nothing there ships in
|
||
|
|
the package.
|
||
|
|
|
||
|
|
## Supported versions
|
||
|
|
|
||
|
|
Only the latest release on npm is supported. There is no backporting; a
|
||
|
|
security fix means a new release.
|