Security Policy
June 7, 2026 · View on GitHub
Supported Versions
Breadcrumbs is maintained by a single developer; security fixes target the latest release and the most recent compatibility branch.
| Version | Obsidian | Supported |
|---|---|---|
| 4.15.x (latest) | 1.13+ | ✅ Active — bug & security fixes |
4.14.x (1.12-compat) | 1.12 | ⚠️ Security fixes only |
| < 4.14 | — | ❌ Unsupported |
Always update to the latest release before reporting an issue, where possible.
Reporting a Vulnerability
Do not report security vulnerabilities in public issues, discussions, or pull requests.
Report privately via GitHub's Report a vulnerability (repo → Security → Advisories). This opens a private channel between you and the maintainer.
Please include, where you can:
- The plugin and Obsidian versions affected
- Steps to reproduce, or a proof of concept
- The impact you believe the issue has
Response Timeline
As a solo-maintained project, timelines are best-effort:
- Acknowledgement: within 7 days of your report.
- Assessment & fix: triaged by severity; a patch for confirmed high-severity issues is aimed for within 30 days.
You'll be kept updated through the private advisory thread.
Disclosure Policy
Breadcrumbs follows coordinated disclosure. Please keep the report private until a fix is released. Once a patch ships, the advisory can be published and — with your permission — you'll be credited for the discovery.
Source Transparency
For a full audit of the plugin's network requests, bundled WebAssembly engine, and non-obvious code patterns (i.e. why a static scan flags certain things), see DISCLOSURES.md.