Reporting a vulnerability
Email hello@queuekeeper.dev with "SECURITY" in the subject. Please include the version or commit, the database engine and version, and steps to reproduce. Do not open a public issue for anything that could be exploited.
We will acknowledge a report within 3 business days and keep you updated until it is resolved. There is no bug bounty.
Supported versions
The project is pre-1.0. Only the latest release (and main) receives security fixes.
| Version | Supported | Notes |
|---|---|---|
| 0.2.x | yes | First public release. |
| 0.1.0 | no | Never tagged or published. mix queue_keeper.check started the host application (and therefore Oban) and some queries could run for minutes on large tables. See docs/SECURITY_REVIEW.md, findings QK-01 and QK-02. |
Scope
In scope: anything in this repository that ships in the package (lib/, mix.exs),
including the SQL it issues, what it reads and prints, and what it starts.
Out of scope: Oban, Ecto, the database adapters and the database servers themselves
(report those upstream), and the example code in dev/ and bench/, which is never
part of the package.
For what the library does and does not do, the exact SQL it issues, the database privileges it needs and the measured performance, see docs/SECURITY_REVIEW.md.