Security is taken very seriously
The current versions, and previous minor versions and / or the past 5 versions are supported. Releases either older than 5 versions, or from the last major version are no longer maintained or monitored, and hence the security of which cannot be guaranteed.
See Docs: Management - Security
If you think you've found a critical issue, please send an email to security@mail.khulnasoft.omg.lol, to encrypt it, you can use 0688 F8D3 4587 D954 E9E5 1FB8 FEDB 68F5 5C02 83A7. You should receive a response within 48 hours.
All non-critical issues can be raised as a ticket.
Please include the following information:
- Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
- Full paths of source file(s) related to the manifestation of the issue
- The location of the affected source code (tag/branch/commit or direct URL)
- Any special configuration required to reproduce the issue
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the issue, including how an attacker might exploit the issue
This info will help with finding and fixing the issue.
Please use only English.
Please do not raise issues in this repo which relate to Vue or Vue CLI, we're already using the latest versions of these dependencies, so any issues here to be taken up with Vue. The same applies to other dev dependencies that are at the latest version.
01/09/2021 - Inefficient Regular Expression Complexity in Axios (Re: CWE-1333).
This ReDos vuln, was raised and fixed by @ready-research in Axios in August 2021. The issue was resolved in 5b45711, but Snyk sometime just takes a while to show updates. Shipyard is using the latest version of Axios, and so is not affected by this issue.