[Security] Possible vulnerability found – can share details privately

[comfyfyfy]

Hi Maintainers 👋

I was exploring Cronmaster and came across what might be a security issue. I’ve put together a working example and steps to reproduce it.

I want to make it clear I’m reporting this in good faith and just hoping to contribute and help improve the project 🙏

I’d prefer not to share the details publicly, so I’m happy to send everything privately (email or any method you prefer).

Please let me know what works best for you, and I’ll send it over.

Thanks for your time!

[fccview]

Hey, do you have a discord account?

Please feel free to join the server and let me know in the cronmaster channel ♥️

I'm on little to no capacity currently due to personal circumstances but I'm on top of bugs and security incidents, so this will be addressed right away if it requires urgency :)

[comfyfyfy]

@fccview Is there a way to report the vulnerability securely? I dont see any ticket channels or private channels present in Discord. or maybe can github security be enabled for this repo? I will submit my findings there

[fccview]

@fccview Is there a way to report the vulnerability securely? I dont see any ticket channels or private channels present in Discord. or maybe can github security be enabled for this repo? I will submit my findings there

yeah I was gonna add you as a friend.
I think my apps gained enough tractions that adding a ticketing system would be wise, so I'll do that in the next few days, thank you for suggesting it.

For now if you confirm in the cronmaster that it's you who just joined I'll add you as friend and you can safely DM me :)

[fccview]

hey @comfyfyfy
I've created a ticketing channel for security reports on discord, that should be safe enough ❤️

[fccview]

This has been fixed in 2.2.0 ♥️
Thank you so much for the help!