Security

Report a vulnerability

SECURITY.md

Security Policy

Reporting a Vulnerability

The preferred way is using the GitHub "Security and quality" Tab in the affected Repository.

Or you can report them via E-Mail:

To Zoey and David: zoeyvid@zvcdn.de, you can find the public key for encrypted communication here: https://github.com/ZoeyVid/.github/blob/main/publickey.asc / https://zvcdn.de/publickey.asc
Only to Zoey: zoey@z0ey.de, you can find the public key for encrypted communication here: https://github.com/Zoey2936.gpg

Any Authenticated user could convert their account to an admin account using the API without proper authorization check.
GHSA-m93x-fhvf-448w published Aug 1, 2026 by Zoey2936

Critical
TOTP could be disabled or backup codes regenerated without entering a valid TOTP code or a valid backup code again by a logged in user
GHSA-p342-94q2-hw5c published Jul 25, 2026 by Zoey2936

Moderate
ACLs got lost after updating to 2026-07-23-r1 or changing some envs in 2026-07-15-r1
GHSA-c8f8-6gxh-hf2g published Jul 24, 2026 by Zoey2936

Critical
Unauthenticated nginx `alias` off-by-slash path traversal → arbitrary read of application secrets (JWT signing key, user database, and DNS-provider API credentials) under /data/npmplus/
GHSA-wj85-328x-ww6r published Jul 23, 2026 by Zoey2936

Critical

Learn more about advisories related to ZoeyVid/NPMplus in the GitHub Advisory Database