Supported versions

sendit follows a rolling release model. Only the latest stable release receives security updates.

VersionSupported
Latest stable✓
All previous✗

Latest security hardening release

The latest stable release is v1.6.0. Security hardening from the July 2026 Codex Security scan shipped in v1.2.5 and remains included in current releases. That hardening keeps supported workflows intact while tightening several defaults:

  • Cross-host HTTP redirects are blocked by default; set http.allow_cross_host_redirects: true only when cross-host redirects are intentional.
  • Opt-in cross-host redirects still pass through per-domain rate limiting before the redirected request is sent.
  • sendit generate --url keeps robots.txt sitemap discovery within the seed origin and skips oversized HTML and sitemap responses.
  • The optional Prometheus metrics listener binds to loopback by default because metric labels include target domains; set metrics.bind_address: 0.0.0.0 only when exposing metrics intentionally.
  • Scheduled pacing remains paused outside active cron windows instead of dispatching after each poll interval.

No CVE has been assigned for this release. See the v1.2.5 release notes for the full changelog and artifacts.

Reporting a vulnerability

Do not open a public GitHub issue for security vulnerabilities.

Use GitHub’s private vulnerability reporting to submit a report confidentially. You will receive acknowledgement within 48 hours and a resolution target within 7 days.

Please include:

  • A description of the vulnerability and its potential impact
  • Steps to reproduce or a proof-of-concept
  • Any suggested fix or mitigation (optional)

Disclosure policy

We follow coordinated disclosure. Once a fix is available, we will publish a GitHub Security Advisory and release a patched version simultaneously. We aim to resolve confirmed reports within 30 days of a confirmed report.

Build provenance

All release artifacts from v0.12.2 onwards include SLSA provenance attestations generated by GitHub Actions. You can verify that a downloaded artifact was produced by this repository’s CI pipeline and has not been tampered with:

gh attestation verify <artifact> --owner lewta

Requires the GitHub CLI (v2.49.0+). On success the command prints the signing certificate details and exits 0; on failure it exits non-zero.

Example:

gh attestation verify sendit_0.12.2_linux_amd64.tar.gz --owner lewta
# Loaded digest sha256:... for file://sendit_0.12.2_linux_amd64.tar.gz
# ✓ Attestation verified — sendit_0.12.2_linux_amd64.tar.gz was attested by https://github.com/lewta/sendit/.github/workflows/release.yml

Security policy

The full security policy is maintained in SECURITY.md in the repository root.