We release patches for security vulnerabilities. Which versions are eligible for receiving such patches depends on the CVSS v3.0 Rating:
| Version | Supported |
|---|---|
| 1.x.x | ✅ |
Please report (suspected) security vulnerabilities to info@unhacked.dev. You will receive a response from us within 48 hours. If the issue is confirmed, we will release a patch as soon as possible depending on complexity but historically within a few days.
Please do not report security vulnerabilities through public GitHub issues.
- Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
- Full paths of source file(s) related to the manifestation of the issue
- The location of the affected source code (tag/branch/commit or direct URL)
- Any special configuration required to reproduce the issue
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the issue, including how an attacker might exploit the issue
We prefer all communications to be in English or Portuguese.
When using NFury, please ensure you:
-
Keep dependencies updated: Regularly update to the latest version of NFury and its dependencies.
-
Use HTTPS for target URLs: When testing APIs, prefer HTTPS endpoints to ensure data integrity.
-
Secure your test environment: Run load tests in isolated environments to avoid impacting production systems.
-
Review test configurations: Double-check target URLs before running tests to avoid accidentally testing production systems.
-
Use authentication properly: When testing authenticated endpoints, ensure credentials are stored securely and not committed to version control.
-
Monitor resource usage: Load testing can consume significant resources. Monitor your system to prevent unintended resource exhaustion.
-
Rate limiting awareness: Be aware of rate limits on target APIs to avoid being blocked or causing issues.
-
Legal compliance: Ensure you have proper authorization before load testing any API that you don't own.
We would like to thank the following security researchers for responsibly disclosing vulnerabilities:
- None yet - be the first!