Please report security problems privately, not in a public issue.
Use GitHub's private reporting form: https://github.com/SethMorrowSoftware/OpenXTalk-Beyond/security/advisories/new (you need to be signed in to GitHub). Only the maintainers can see the report. GitHub's documentation explains how private reporting works.
If the form ever says that it is not available, open an ordinary issue that says only that you have a security report and would like a private way to send it. Do not include any details of the problem in that issue. A maintainer can then open a draft security advisory, which only the maintainers and the people added to it can see, and add you to it so that you can send the details there.
Please include:
- the OXT-Beyond version and build number (the version is in the title
of the menubar window, for example "OXT-Beyond 0.2.7-rc.2", and in
ide/.versionof a source checkout; the build number is under Preferences > Automatic Updates), and your operating system and version (Windows; macOS, Apple Silicon or Intel; or your Linux distribution); - which package you use (the installer or the portable zip on Windows,
the disk image or the app zip on macOS, the Linux tar.xz run in place
or installed with
install.sh); - what an attacker can do, and what they need first (for example, "a user opens a crafted stack file");
- steps or a small stack or script that shows the problem.
This is a small volunteer project. There is no bug bounty and no guaranteed response time, but reports will be read and answered as soon as possible. Please give us a reasonable amount of time to fix a problem before you publish details.
Problems in OpenXTalk Lite itself, in LiveCode or in the OpenXTalk forums' own software are outside this project; report those to their maintainers.
Only the latest release, and the main branch, get fixes. A
pre-release (a release candidate such as 0.2.1-rc.1) is for testing: it
gets no fixes of its own, and the next pre-release or release replaces
it.
The Windows binaries (the installer, OXT-Beyond.exe and the other
programs and libraries) are not code-signed, so Windows SmartScreen
may warn about them. The macOS app is signed ad hoc, with a
signature that lets macOS check that the app's files are intact but
names no Apple Developer ID, and it is not notarized by Apple, so macOS
blocks it until you allow it (see the README's macOS section). The Linux package is not signed. Download
them only from this repository's
Releases page
and check them against the SHA256SUMS file of the same release, which
lists every file of the release, for example:
certutil -hashfile OXT-Beyond-0.1.0-win-x86_64-setup.exe SHA256On macOS, shasum -a 256 <file>; on Linux, in the folder with the
download and SHA256SUMS, sha256sum -c SHA256SUMS --ignore-missing.
Development builds (workflow artifacts on the Actions tab) are made by the same workflows but are not reviewed as releases.
The standalone runtimes for the other platforms in each package come
from a release asset of this repository (runtimes-0.2.8-dp.1), which
the packager downloads and refuses unless its SHA-256 matches the one
recorded in
tools/oxt/external-assets.json. The
Windows and Linux runtimes in it are built from this repository by its
CI, with the same libraries as the packages themselves, and so are the
Android runtime's Java layer and OXT-Beyond's own Android engine
(Runtime/Android/Beyond, used only for a stack whose settings ask for
it, as the Standalone Settings do from 0.2.8 for a stack set up for
Android for the first time). The other Android engines in it, which the
builder uses for every other stack, are not: they are OpenXTalk Lite 1.15's,
taken unchanged (LiveCode 9.6.3 builds and files as Tom Perry shipped
them), and have not been rebuilt or updated. See
THIRD-PARTY-NOTICES.md.
OXT-Beyond's update check (Help > Check for Updates, and the automatic check if you turn it on in Preferences > Automatic Updates; it is off by default):
- asks GitHub's API (
api.github.com) over HTTPS for this repository's latest release, and for the list of its releases when the latest one is not an OXT-Beyond version (for exampleprebuilts-v1) or when you run a pre-release, and reads the version number (the release'svtag), name and notes from the answer; pre-releases are offered only to people who already run a pre-release; - identifies itself to GitHub as OXT-Beyond with its version number (the User-Agent header), and sends nothing else about you or your computer beyond what any web request carries (such as your IP address);
- if the release is newer than yours, shows its notes and a button that opens the release page on github.com in your browser, and does nothing else;
- never downloads, installs or runs anything, never writes into the program folder and never asks for administrator rights;
- never contacts OpenXTalk Lite's update servers (tsites.co.uk, openxtalk.net).
You update by downloading the new installer, disk image or archive from the Releases page yourself and checking it as described above.
OpenXTalk Lite's own updater worked differently: it downloaded IDE
files from Tom Perry's servers and copied them into the program folder
with a script run with administrator rights. OXT-Beyond does not use
it. Its stack (Toolset/palettes/updates/updates.livecode) is still in
the program folder, unchanged, because binary stacks were not re-saved
for this release, but the IDE no longer opens it.
Some Help menu items open web pages in your browser, for example the OpenXTalk forums (openxtalk.org) and Dictionary Online (openxtalk.net). They are ordinary links; nothing is downloaded into OXT-Beyond.
OpenSSL, curl and ICU are current releases, built from source for all three platforms (from 0.2.1-rc.3 on; before, the builds used the versions LiveCode Community last shipped):
| Component | Version in this build | Status |
|---|---|---|
| OpenSSL | 3.5.9 (September 2026) | The 3.5 series is a long-term support release, supported until April 2030 (release strategy). Earlier releases of OXT-Beyond shipped 1.1.1g on Windows and 1.1.1w on Linux and macOS; the 1.1.1 series reached end of life in September 2023. |
| curl (libcurl) | 8.22.0 (September 2026) | Current; see curl's vulnerability table. Used by the server engine (on macOS the server engine uses the system's libcurl). Earlier releases had 7.51.0 (2016). |
| ICU | 78.3 (March 2026) | Current. Earlier releases had 58.2 (2016). |
| zlib | 1.3.2 (February 2026) | Current. Earlier releases had 1.2.8 (2013). |
| libpng | 1.6.59 (September 2026) | Current. Earlier releases had 1.6.26 (2016). |
| giflib | 5.2.2 (February 2024) | The current release of the 5.x series, whose interface the engine uses. Earlier releases had 5.1.4 (2016). |
| libjpeg (IJG) | 9f (January 2024) | Current. Earlier releases had 9b (2016). |
| libxml2 | 2.15.4 | Current. Used by revXML. Earlier releases had 2.9.4 (2016). Its HTTP and FTP clients, which revXML uses for http:// and ftp:// URLs as 2.9.4 did, are 2.14.6's and 2.13.9's, the last releases that had them (2.15 and 2.14 removed them): plain HTTP and FTP, without TLS. revXML lets entities expand to 1000 times the size of the document read (2.15's default is 5 times; 2.9.4 had no limit), so that ordinary documents that reuse a large entity parse; nested entities that expand without bound ("billion laughs") are still refused. |
| libxslt | 1.1.45 (November 2025) | Current. Used by revXML for XSLT. Earlier releases had 1.1.28 (2012). Recursion is limited to 3000 nested template calls, as in 1.1.28, and goes past 1.1.45's own, lower count only while 96 KB of the C stack are left, where it stops with an error (see thirdparty/libxslt/ORIGIN). On small stacks (512 KB, as on iOS) a recursive stylesheet can still run out of stack within 1.1.45's count, as it could with 1.1.28. |
| libzip | 1.12 (October 2026) | Current. Used by revZip. Earlier releases had a modified libzip 0.6.1 (July 2005). |
| MariaDB Connector/C | 3.4.11 (2026) | Current. The client library of the MySQL database driver since 0.2.8; it connects to MySQL (5.x to 8.4 and later) and MariaDB servers, including MySQL 8's default caching_sha2_password login. Earlier releases had MySQL Connector/C 6.0.0 (2009), whose encrypted connections asked for TLS 1.0 only until 0.2.7-rc.6.11 (#290). As before, the driver uses TLS only when the script asks for it and does not check the server's certificate (see thirdparty/libmysql/ORIGIN). |
| libpq (PostgreSQL) | 17.11 (August 2026) | Current. The client library of the PostgreSQL database driver since 0.2.8; it logs in with SCRAM-SHA-256, the default of PostgreSQL 14 and later. Earlier releases had libpq from PostgreSQL 9.4.5 (2015). As before, the driver uses TLS when the server offers it unless the script says sslmode=disable (see thirdparty/libpq/ORIGIN). |
| PCRE | 8.45 (June 2021) | The last release of PCRE 1, which is no longer maintained (its successor, PCRE2, has another interface); it has the fixes for the published vulnerabilities of PCRE 1. Earlier releases had 8.39 (2016). |
These are still old and have publicly known vulnerabilities:
| Component | Version in this build | Status |
|---|---|---|
| CEF / Chromium | CEF 74.1.19, Chromium 74.0.3729.157 (2019) | Years of unpatched browser vulnerabilities. Used by the browser widget and revBrowser on Windows and Linux. Do not use them to display content you do not trust. |
Other libraries in thirdparty/ (cairo 1.9.4 and others) are
also several years old. SQLite was updated
to 3.51.1, and to 3.51.3 in 0.2.7-rc.6.18 (the fix for the WAL-reset
database corruption bug).
Upgrading these libraries is planned. Until then, treat the browser components and any network or file-parsing features as unsafe for untrusted input. THIRD-PARTY-NOTICES.md lists every bundled component.
Stacks are programs: opening a stack can run its scripts. Only open stacks from sources you trust.