If you find a security vulnerability in OpenTokenUsage, please report it privately. Do not open a public issue.
- Go to the Security Advisories page
- Click "Report a vulnerability"
- Fill in the details
This keeps the report private between you and the maintainer until a fix is released.
- Description of the vulnerability
- Steps to reproduce
- Affected versions
- Impact assessment (what can an attacker do?)
- Acknowledgment as soon as possible, usually within a few days
- An assessment and a plan once the report is confirmed
- A fix released as soon as practical, depending on severity, with credit to you if you want it
The following are in scope:
- The OpenTokenUsage desktop application, including its local HTTP API
- Provider plugins shipped with OpenTokenUsage
- The updater and the build and release infrastructure
- The website, opentokenusage.app
The following are out of scope:
- Third-party provider APIs (report to the provider directly)
- Social engineering attacks
- Denial of service attacks
Only the latest release is supported with security updates. The app updates itself, so staying current is one click.