Report vulnerabilities privately through GitHub's vulnerability reporting. Don't open a public issue.
Include:
- The Tunarr version and how it's installed (Docker, binary, other)
- Steps that reproduce the problem against a real Tunarr build
- What an attacker can do with it, and what access they need first
You may use AI tools or scanners to find problems. Before you report one, confirm it yourself against a running Tunarr build. Reports of unconfirmed AI or scanner output will be closed without a detailed response.
Only the latest stable release receives security fixes.