Backup Manager handles production database dumps and RDS credentials. Security issues are taken seriously and prioritized ahead of feature work.

Do not open a public GitHub issue for a security vulnerability.

Instead, use GitHub's private reporting flow: github.com/mherrera53/backup-manager/security/advisories/new

Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce, or a proof of concept
• The affected version / commit

You should expect an initial response within a few days. Once a fix is available, a security advisory will be published and credit given to the reporter (unless anonymity is requested).

In scope:

• Credential handling (Keychain integration, MYSQL_PWD usage, encrypted config in ProfileStore)
• Shell/SQL injection via unescaped user input
• Presigned URL / distribution token generation (ShareLinkService, DistributionView)
• Sanitization logic that could leave PII unsanitized

Out of scope:

• Vulnerabilities requiring physical access to an already-unlocked Mac with Keychain access already granted
• Issues in third-party CLI tools the app shells out to (mysql, aws, gh, pigz, pv) -- please report those upstream

This project does not yet follow semantic versioning with parallel maintenance branches. Security fixes are applied to the master branch; please always run the latest build.