The maintainers of the Shescape project take security issues seriously. We appreciate your efforts to responsibly disclose your findings. Due to the non-funded and open-source nature of the project, we take a best-efforts approach when it comes to engaging with security reports.

This document should be considered expired after 2025-06-01. If you are reading this after that date you should try to find an up-to-date version in the official source repository.

The table below shows which versions of the project are currently supported with security updates.

This table only includes information on versions <3.0.0.

To report a security issue in the latest version of a supported version range, either (in order of preference):

• Report it through GitHub, or
• Send an email to security@ericcornelissen.dev with the terms "SECURITY" and "shescape" in the subject line.

Please do not open a regular issue or Pull Request in the public repository.

To report a security issue in an unsupported version of the project, or if the latest version of a supported version range isn't affected, please report it publicly. For example, as a regular issue in the public repository. If in doubt, report the issue privately.

Consider if the issue you found really is a security concern. Below you can find guidelines for what is and isn't considered a security issue. Any issue that does not fall into one of the listed categories should be reported based on your own judgement. If in doubt, report the issue privately.

Any issue that is out of scope should still be reported, but can be reported publicly because it is not considered sensitive.

• Insecure suggestions or snippets in the documentation.
• Insufficient escaping for any supported shell.
• Logic bugs with a security implication that can be triggered through the public API.
• Security misconfigurations in the continuous integration pipeline or software supply chain.

• Bugs only affecting the shescape/testing module.
• Insecure defaults or confusing API design.
• Insufficient escaping for any unsupported shell.
• Known vulnerabilities in third-party dependencies or devDependencies.

Try to include as many of the following items as possible in a security report:

• An explanation of the issue
• A proof of concept exploit
• A suggested severity
• Relevant CWE identifiers
• The latest affected version
• The earliest affected version
• A suggested patch
• An automated regression test
• A fuzz input seed or test

An advisory will be created only if a vulnerability affects at least one released versions of the project. The affected versions range of an advisory will by default include all unsupported versions of the project at the time of disclosure.

This table is ordered most to least recent.

We would like to publicly thank the following reporters:

• Elliot Ward (@mowzk) from Snyk