Security policy

Supported versions

Security fixes target the latest published release and the current master branch. Older releases may not receive backports; users should reproduce a suspected issue on the latest version when safe to do so.

Reporting a vulnerability

Do not open a public issue for vulnerabilities that could expose credentials, execute unintended commands, escape filesystem boundaries, replace release artifacts, or otherwise harm users.

Use GitHub's Report a vulnerability option on the repository Security tab to create a private security advisory:

https://github.com/vorlie/ani-cli-rs/security/advisories/new

Include:

• The affected version, operating system, and architecture.
• Reproduction steps or a minimal proof of concept.
• The expected security boundary and practical impact.
• Any suggested mitigation, if known.

Remove real credentials, cookies, authorization headers, and active media URLs. Use synthetic values wherever possible. Please allow reasonable time to investigate and prepare a release before publishing details.

Provider outages, expired links, antivirus heuristics without an exploitable security impact, and ordinary playback failures should use the public issue templates instead.