Please report suspected vulnerabilities privately using GitHub private vulnerability reporting. You do not need a ServiceStack account or paid subscription to report through GitHub. Alternatively, use the ServiceStack security reporting portal. Please use one channel per report; there is no need to submit duplicates.

Do not report vulnerabilities through public GitHub issues, discussions, or pull requests.

For non-security bugs, use ServiceStack/Issues. The ServiceStack/ServiceStack repository does not accept public issues.

Our security policy describes the reporting process, scope, response targets, and coordinated disclosure.

• Affected repository, NuGet package, and exact version or commit.
• Relevant runtime, operating system, configuration, and authentication requirements.
• Reproduction steps and a minimal proof of concept, where possible.
• Observed impact, prerequisites, and any suggested mitigation.
• Your preferred contact details and whether you would like public credit.

Please omit credentials, personal information, and other sensitive data from reproductions.

Please report suspected vulnerabilities in any version, including pre-release packages. Include the exact version so we can determine the affected range and provide upgrade guidance. Security advisories identify affected versions, available fixes, and mitigations. A pre-release fix is identified separately from a stable release. Use the latest stable release where possible and consult each advisory for the required fixed version.

We aim to acknowledge reports within three business days and provide an initial assessment within ten business days. These are response targets, not guaranteed resolution times. We will coordinate disclosure with the reporter while investigating and preparing a fix. Please keep exploit details private during this process. We will agree researcher credit before publication.

Published advisories are available on GitHub Security Advisories.