Security fixes are provided for the latest released version and for the main branch. Older versions are not supported.

Please do not open a public issue for a security vulnerability.

Use GitHub's private vulnerability reporting:

https://github.com/thib3113/node-crowdsec/security/advisories/new

If private reporting is unavailable, contact the maintainer at thib3113@gmail.com.

Please include:

• the affected package and version;
• steps to reproduce, with a minimal example;
• the impact you expect;
• a possible fix, if you have one.

We aim to acknowledge every vulnerability report within 30 days. After triage we agree a remediation plan and a disclosure date with the reporter. Critical issues are prioritised, with a target fix within 90 days of a confirmed report. Please allow time for a fix before public disclosure.