Security fixes target the latest release and the main branch.

Use GitHub's private vulnerability-reporting form in the repository's Security tab. Do not include exploit details, credentials, endpoint logs, or other sensitive data in a public issue. If the private form is unavailable, contact the maintainer through the repository owner's GitHub profile to arrange a private channel.

Useful reports include:

• writing, replacing, or deleting a path Stinger does not own;
• unsafe handling of symlinks, permissions, or file identity;
• secret values exposed through Stinger-generated output;
• cleanup removing user-created data;
• a fanotify bait open succeeding after the backend reports that the exact bait is armed and while the watcher remains healthy;
• a child that remains in the documented process-group or session scope escaping the documented response; or
• a documented bait failing under the conditions it claims to support.

Include the operating system, Stinger version or commit, command used, expected behavior, and a minimal synthetic reproduction. Never use real credentials or malware samples.

Stinger is endpoint deception, not containment. The following are documented limitations rather than vulnerabilities by themselves:

• code that never interacts with an active Stinger trap;
• reads of regular compatibility stubs, directory listings, or metadata-only inspection;
• nonblocking access that avoids the FIFO delay;
• absolute paths, direct credential APIs, or discovery of the real HOME;
• renamed binaries or direct APIs that bypass credential-command tripwires;
• detached processes outside the protected process-group or session scope;
• same-user inspection or tampering;
• fanotify being unavailable because of the kernel, filesystem, namespace, or missing CAP_SYS_ADMIN;
• the fanotify startup window before exact bait marks are installed, or loss of denial after the watcher exits; and
• lack of network isolation or egress control.

CAP_SYS_ADMIN is a broad Linux privilege. Grant it only to a dedicated Stinger binary in a controlled environment, and do not run Watch Mode as root against another user's HOME.

Protected commands are stored as an executable basename and argument count, without argv values. Paths and optional process snapshots may still be sensitive. Handle them accordingly when testing or reporting an issue.