UnpackProof is a regression testing CLI for synthetic TAR fixtures in disposable Docker containers. It is not a security scanner or a guarantee that an extractor is safe. Its observer checks final snapshots and may not detect changes reverted before observation.
Do not publish vulnerability details, secrets or exploit archives in an issue or pull request.
If GitHub offers Report a vulnerability on the repository's Security page, use that private reporting channel. If it is unavailable, open an issue asking the maintainer for a private contact channel without describing the vulnerability. Wait for a private channel before sharing sensitive details.
A useful private report includes:
- Affected release or commit, host platform and Docker engine architecture/version.
- The affected command, configuration and image identity.
- Expected and observed behavior, impact and prerequisites.
- Minimal reproduction steps using benign synthetic fixtures where possible.
- Relevant report excerpts with credentials, personal data and unrelated paths removed.
Do not test against shared or production resources, or send large or untrusted archives as an initial report. Coordinate any additional reproduction material privately.
Reproduce on the latest release or main when possible. Fixes target current development and the next applicable release; the project does not promise backports to older versions or a fixed response timeline. Published tags are not rewritten. Release changes are recorded in CHANGELOG.md.
Keep Docker and the host system maintained, use known images, and retain the configured execution and storage limits. Do not grant targets privileged access, mount the Docker socket, or replace disposable fixtures with valuable host data.
Isolation, report integrity, outcome classification and cleanup ownership are relevant security concerns. An extractor's expected rejection, or a documented snapshot limitation on its own, is not evidence of a vulnerability in UnpackProof. Include the concrete impact when reporting a concern.