The following versions of metrica-tag are currently being supported with security updates:

We're extremely grateful for security researchers and users that report vulnerabilities to the metrica-tag Open Source Community. All reports are thoroughly investigated by developers.

metrica-tag is the part of "The Yandex Bug Bounty" program. To report a vulnerability in metrica-tag please send detailed report using this form.

• You think you discovered a potential security vulnerability in metrica-tag
• You are unsure how a vulnerability affects metrica-tag

• You need help tuning metrica-tag components for security
• You need help applying security related updates
• Your issue is not security related

Each report is acknowledged and analyzed by metrica-tag maintainers within 5 working days. As the security issue moves from triage, to identified fix, to release planning we will keep the reporter updated.

A public disclosure date is negotiated by the metrica-tag maintainers and the bug submitter. We prefer to fully disclose the bug as soon as possible once a user mitigation is available. It is reasonable to delay disclosure when the bug or the fix is not yet fully understood, the solution is not well-tested, or for vendor coordination. The timeframe for disclosure is from immediate to 90 days. For a vulnerability with a straightforward mitigation, we expect report date to disclosure date to be on the order of 7 days.