Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version	Supported
1.18.x	✅
<1.18.x	❌

Reporting a Vulnerability

Please use issues to report about any security issue.

SQLite identifier injection in the deep scanner causes CPU denial of service
GHSA-r43q-3f2h-7938 published Sep 10, 2026 by babenek

Moderate
Untrusted marshal input causes attacker-sized tuple allocation in the pycache deep scanner
GHSA-v3p7-c6pg-g375 published Sep 10, 2026 by babenek

Moderate
CredSweeper GitHub Action argument injection allows arbitrary command execution via --log_config
GHSA-q5pw-pp6j-mvfc published Jul 3, 2026 by babenek

High
Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources
GHSA-9mqm-qcwf-5qhg published Jun 3, 2026 by babenek

Moderate

Learn more about advisories related to Samsung/CredSweeper in the GitHub Advisory Database