Security

If you’ve found a security issue in any Charcoal project, please don’t post it publicly (including in Charcoal HQ, our chatroom). Instead, email details of the vulnerability to [email protected], which is a mailing list that will reach the necessary people. They’ll have a look and confirm whether or not it’s a security issue, and deal with it appropriately.

If you’d like to encrypt your email, you can find our PGP key here: https://metasmoke.erwaysoftware.com/security-pubkey.txt

Acknowledgements

We’d like to extend special thanks to these people, who have helped us out by reporting security vulnerabilities to us.

• teward - improper SQL dump sanitization and handling
• NobodyNada - server memory dump disclosure
• user12986714 - SQL injection vulnerability