Fixes go to the latest main and to the latest tagged release. Older releases are not patched.

Use GitHub's private vulnerability reporting on this repository: open the Security tab and file a draft advisory. That keeps the report private until there is a fix. Please do not open a public issue for a security problem, and please do not send it to a maintainer's personal address.

Say what you did, what happened, and which version or commit you were on. A first reply usually takes a few days, since this is a volunteer project.

In scope:

• Credentials leaking anywhere they should not go: to a host other than the configured proxy, into synced storage, into a log, into a page, or out through a message channel.
• Authentication bypass on the proxy, or any way to use it without a valid account.
• Getting past the destination rules, for instance reaching localhost, a link-local address or a private range through the proxy, or relaying to a port other than 80 and 443.
• Weaknesses in how the installer or the CLI writes files, sets permissions or handles account names and passwords.
• Anything that lets one user of a proxy learn about another user's traffic.

Out of scope:

• Actions that need root on the VPS already. Anyone with root can change the proxy configuration outright.
• The http scheme in the extension's manual entry form, which sends credentials in clear by design and says so on the page.
• Loading the extension unpacked, or a token that its holder gave away.
• Reports from automated scanners with no working path to an impact.

Exitway does not protect you from the person who runs the server: root on the VPS means the ability to watch traffic, change the log format, or add TLS interception, and no code shipped here can prevent that. The exitway audit command reports on those settings so a change can be spotted, which makes it a spot-check rather than a guarantee, and a finding that the operator could subvert it is not a vulnerability in Exitway.