OpenCaptive is under active development. Security fixes are applied to the latest main branch and the most recent release.

Please do not report security vulnerabilities through public GitHub issues.

Instead, report them privately using one of the following:

1. GitHub Security Advisories — use the Report a vulnerability button on the repository's Security tab. (Preferred)
2. Email — send details to dcjvanginneken@gmail.com.

Please include:

• A description of the vulnerability and its impact
• Steps to reproduce (proof-of-concept if possible)
• Affected component(s) and version/commit
• Any suggested mitigation

• Acknowledgement within 72 hours.
• An assessment and, if confirmed, a remediation plan.
• Coordinated disclosure — we'll keep you informed and credit you (if you wish) once a fix is released.

Thank you for helping keep OpenCaptive and its users safe. 🙏