If you discover a security vulnerability, please report it responsibly:
- Do NOT open a public issue
- Email the maintainer directly or use GitHub's private vulnerability reporting
- Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
- Acknowledgment: Within 48 hours
- Initial assessment: Within 7 days
- Fix timeline: Depends on severity
Security issues we care about:
- Authentication/authorization bypasses
- Data leaks (API keys, tokens, personal data)
- Remote code execution
- Injection vulnerabilities
Out of scope:
- Issues requiring physical device access
- Social engineering
- Third-party dependencies (report to them directly)
| Version | Supported |
|---|---|
| 1.x | Yes |
Thank you for helping keep OpenVision secure!