Security fixes go into the newest release only, so update before you report.

Please don't report security problems in public issues, pull requests or discussions.

Report them privately on GitHub: open the Security tab of this repository and click Report a vulnerability (direct link). Only the maintainers see the report.

Please include:

• the PumboPerms version, and whether you run it on PumboProx or on Pumpkin (with their versions);
• what an attacker can do, and the steps or a proof of concept to reproduce it;
• the relevant parts of your config, without secrets.

We confirm that the report arrived, work on the fix in a private advisory and publish it together with a release. You are credited in the advisory unless you prefer not to be.

What a trusted admin can do on purpose with the rights PumboPerms gives is not a vulnerability; the Security section of docs/commands.md describes such rights where a plugin has them.

Problems in the proxy or in the shared libraries go to PumboProx, problems in Pumpkin itself to the Pumpkin project.