Cairn is pre-1.0. Security fixes are applied to the latest minor release only.

Please report security issues privately. Do not open a public issue, a discussion, or a pull request describing the problem.

Use GitHub's private vulnerability reporting, or email divoto@gmail.com.

Please include:

• a description of the issue and what an attacker could achieve;
• the affected version, PHP version and Laravel version;
• reproduction steps or a proof of concept;
• any suggested fix, if you have one.

You can expect an acknowledgement within 72 hours and an assessment within seven days. Once a fix is released, you will be credited in the advisory unless you ask not to be.

Cairn is an analytics package whose central promise is about data it refuses to collect. Alongside conventional vulnerabilities, the following are treated as security issues and are in scope:

• Any path by which a raw IP address is persisted — to a database column, a log line, a cache entry, an exception message, or a queue payload.
• Any path that reconstructs cross-day visitor identity in the default configuration, or that makes the visitor salt recoverable from disk, the database, or an error message.
• Any cookie or session write in the default configuration.
• Unauthorised access to the dashboard or the JSON API, including a bypass of the viewCairn gate or leakage across tenant boundaries.
• Leakage of another tenant's data through the report builder, the API or the dashboard.
• Injection through collected values — referrer, user agent, UTM parameters, event names, custom properties, or the beacon payload.

• Vulnerabilities in Laravel, PHP or third-party dependencies — report those upstream.
• Findings that require the deployer to have explicitly enabled a documented personal-data option (track_user_id, durable_identity, city-level geo). These change the deployer's data-protection position by design and say so in the configuration file. A bug in how they behave is still in scope; the existence of the option is not.
• Denial of service through unrealistic request volume against an unprotected collect endpoint that the deployer has not rate-limited.
• Reports generated by automated scanners with no demonstrated impact.