Security fixes are provided for the latest released version.
| Version | Supported |
|---|---|
| 1.0.x | ✅ |
| < 1.0 | ❌ |
Please do not open a public issue for security problems.
Report vulnerabilities privately through GitHub: Security → Report a vulnerability.
Include a description, the affected version, and a minimal program that reproduces the issue. We aim to acknowledge reports within a few business days and to release a fix or mitigation as soon as a valid issue is confirmed.
This package is a provider for TagBites.IO. The core security model - no sandbox, paths are the only limit, advisory permissions, content buffered through the system temporary directory - is described in the core security policy. What follows is specific to this provider.
An access key and a secret key, held in memory for the lifetime of the file system. Scope them to the bucket that is actually used.
The service URL is taken as given, which is what allows S3-compatible servers such as MinIO or Cloudflare R2. Point it only at endpoints you trust; the credentials are sent there.