Security updates and patches are applied to the following versions:

Please make sure you are using the latest version of RemoteVars before reporting issues.

a If you discover a security vulnerability within RemoteVars:

1. Do not open a public issue.

2. Instead, please email the maintainers directly at:

   contact@josergarcia.dev
   

3. Include:

   • A detailed description of the vulnerability
   • Steps to reproduce (if possible)
   • Any possible mitigations or suggested fixes

We’ll respond as soon as possible, usually within 48 hours.

We ask that all security researchers:

• Respect user privacy and data integrity.
• Allow reasonable time (usually 30 days) for us to release a patch before public disclosure.
• Avoid exploitation or public demonstration without prior coordination.

For users of RemoteVars:

• Avoid sharing .remotevars.json files with private tokens or credentials.
• Prefer GitHub repositories with limited scopes or read-only access tokens.
• If using HTTP providers, ensure you use HTTPS endpoints.
• Regularly rotate credentials and access tokens.