Security Policy

Supported versions

Security fixes are provided for the latest 1.0.x release line. Older development snapshots and unsupported PGMQ configurations do not receive security fixes.

Reporting a vulnerability

Please do not open a public issue for a suspected vulnerability. Use GitHub private vulnerability reporting so the report and follow-up remain private until a coordinated disclosure is appropriate.

Include, when available:

• the affected pgmq-cpp, PostgreSQL, PGMQ, compiler, and operating-system versions;
• a minimal reproducer or the exact call sequence;
• the expected and observed security boundary;
• whether untrusted SQL, queue names, message bodies, or connection strings are involved;
• potential impact and any known mitigation.

Remove production credentials, tokens, customer data, and private connection strings before submitting a report. The project will acknowledge and triage reports through the private advisory; no response-time or remediation-time SLA is promised.

For ordinary correctness bugs that do not contain sensitive information, use a public GitHub issue instead.