Click here for the Japanese version of this file.

Security fixes are applied to the latest release line only.

Prerelease packages (-preview* / -alpha*) are for evaluation and are not supported.

Please do not open a public issue for a security problem.

Use Private vulnerability reporting. The report stays private until a fix is published, and the discussion happens in the same place.

Please include:

• Which assembly and version (for example, OpenTouryo.Public.Security 3.0.0)
• Which target framework (net48 or net10.0) — the two are separate implementations in several places, so a problem may exist in only one of them
• Steps to reproduce, or the code path you believe is affected
• What an attacker gains

We are a small team. We will acknowledge the report and tell you what we intend to do, but we cannot promise a fixed turnaround time.

This repository contains both the framework and the samples that show how to use it.

Static analysis (CodeQL) runs on this repository, and its findings have been triaged. Before reporting a scanner result, please check #536 — it records what was fixed, what was dismissed, and why.

The following are known and deliberate:

• CipherMode_ECB is marked [Obsolete]. It is one of five cipher modes the caller can choose, and it is not the default — when no mode is given, .NET's default (CBC) is used. It is kept for backward compatibility
• BinarySerialize (BinaryFormatter) exists for net48 only. It is excluded from the net10.0 build (<Compile Remove> in Public_netcore100.csproj)
• Sample Web.config files use requireSSL="false", because the samples are meant to be run over HTTP. The production setting is provided next to it, commented out, with a note to enable it

Reports that show a concrete exploit for any of the above are still welcome.

The settings themselves live on GitHub and are not visible from the files in this repository, so they are written down in GitHubUsage.md.