Security updates are provided for the latest released version of Flashbang. Users of the hosted service at flashbang.tech receive updates when they are deployed. Self-hosters should update to the latest GitHub release.
Please do not report suspected vulnerabilities in a public issue, discussion, or pull request.
Report them privately through GitHub's private vulnerability reporting form. Include as much of the following as possible:
- A description of the vulnerability and its potential impact
- The affected version, commit, deployment, or configuration
- Reproduction steps or a proof of concept
- Any known mitigations or workarounds
Reports are reviewed on a best-effort basis, and we cannot guarantee a response or resolution timeline. If we investigate the report, we may contact you for more information or to coordinate public disclosure. Please allow a reasonable amount of time for a fix to be developed and released before sharing the vulnerability publicly.
Reports made in good faith to help improve Flashbang's security are welcome.