pointback has one maintainer, Abhijeet Halder, and no security team or bug bounty. Everything promised below is something one maintainer can keep.
Do not report a vulnerability anywhere public. Report it privately through GitHub: open this repository's Security tab and choose Report a vulnerability, or go straight to https://github.com/Abhijeet34/pointback/security/advisories/new. That opens a draft advisory only the maintainer can see, and the two of you discuss it there in private until a fix ships.
A useful report names the version or commit you tested, your operating system and runtime, the steps that reproduce the problem, and what an attacker ends up with. A proof of concept helps, and it is never required.
- An acknowledgement within 7 days of the report arriving.
- An assessment within 30 days of that acknowledgement: whether it reproduces, how severe it is, and whether a fix is coming.
- A fix as soon as it is ready, with credit to you if you want it.
If either date is going to slip, you are told before it passes.
Releases are this repository's GitHub releases, and only the newest one is supported.
Fixes land on main and ship in the next release, with no backports.
Report against the newest release or against main, and say which.
A report is actionable when it shows a path through this project's own code. Scanner output, or an advisory against a dependency, with no demonstrated path through pointback is worth a note but is not a vulnerability in it.