The following versions of svn-binary are currently supported with security updates:

We take security vulnerabilities seriously. If you discover a security issue, please follow these steps:

Do not open a public issue for security vulnerabilities.

Instead, please report security issues via:

1. GitHub Security Advisories: Use the Security tab in this repository
2. Email: Contact the maintainers directly at security@codesnippetspro.com (if configured)

When reporting a vulnerability, please provide:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact and severity assessment
• Suggested fix or mitigation (if known)
• Your contact information for follow-up

• Acknowledgment: We will acknowledge receipt within 48 hours
• Initial Assessment: We will provide an initial assessment within 5 business days
• Resolution: Critical vulnerabilities will be addressed with high priority; timeline depends on complexity

• Security issues will be privately addressed before public disclosure
• We will coordinate disclosure timing with the reporter
• Public disclosure will occur after a fix is released and users have time to update

When using this action:

1. Pin versions: Use specific version tags (e.g., @v1.0.0) rather than @main
2. Credential management: Use GitHub Secrets for sensitive credentials (SVN passwords, tokens)
3. Review dependencies: Regularly update to the latest supported version
4. Audit usage: Monitor action logs for unexpected behavior

This action uses docker run and docker exec commands on the GitHub Actions runner. While the action itself does not bind-mount the Docker socket or use privileged mode, users should be aware that:

• The action requires Docker to be available on the runner
• Commands are executed via Docker on the runner host
• Ensure your runner environment follows security best practices

When using SVN commands with authentication:

• Always use GitHub Secrets for credentials
• Use --no-auth-cache flag to prevent credential caching
• Use --non-interactive to avoid interactive prompts
• Review logs to ensure credentials are not inadvertently exposed

For security-related questions or concerns, please contact the maintainers through the appropriate channels listed above.