PumboProx is in beta. Security fixes go into the newest release only, so update before you report.

Please don't report security problems in public issues, pull requests or discussions.

Report them privately on GitHub: open the Security tab of this repository and click Report a vulnerability (direct link). Only the maintainers see the report.

Please include:

• the PumboProx version (pumboprox version) and how you run it (binary, Docker, from source);
• the Pumpkin version and the plugins involved;
• what an attacker can do, and the steps or a proof of concept to reproduce it;
• the relevant parts of your config, without secrets.

We confirm that the report arrived, work on the fix in a private advisory and publish it together with a release. You are credited in the advisory unless you prefer not to be.

Problems in Pumpkin itself go to the Pumpkin project. Problems in one of the Pumbo plugins go to that plugin's repository, the same way.