Report vulnerabilities privately through GitHub private vulnerability reporting for this repository.

If you cannot use GitHub reporting, contact Cloudinary support at support.cloudinary.com and mark the ticket as a security issue.

Use these private channels for anything security-sensitive; public GitHub issues are for regular bugs and feature requests.

• The affected package version and target framework (.NET Framework, .NET Standard, or .NET version).
• A minimal reproduction or proof of concept.
• The impact you believe the issue has (for example: credential exposure, signature bypass, request forgery).
• Any suggested remediation, if you have one.

• We acknowledge reports and keep you informed while the issue is investigated.
• Fixes are released as patched package versions; the changelog notes security-relevant changes without disclosing exploit details before users can upgrade.
• Please give us reasonable time to release a fix before public disclosure.

• Your API secret is a server-side credential. Keep it on your server; browsers, mobile binaries, and repositories should only ever hold delivery URLs or short-lived signatures.
• Never reference this package from a client-side project — Blazor WebAssembly, MAUI, Unity, or a desktop app. Anything the user can download, they can read. Call your own backend instead.
• Provide credentials through the CLOUDINARY_URL environment variable, or a secret store, rather than hardcoding them or committing them in appsettings.json.
• For uploads initiated from a browser or mobile app, generate the signature on your server. See docs/sign-browser-upload.md.
• For unsigned uploads, use a deliberately restricted unsigned upload preset (md).
• Do not log a full Admin or Upload API request object; it can contain your credentials. Log result.Error.Message instead.
• Verify webhook callbacks with Api.VerifyNotificationSignature before acting on them.
• Cloudinary platform security documentation: https://cloudinary.com/documentation/solution_overview#security