The latest 3.x release gets security fixes.
Report it in private. Use GitHub private vulnerability reporting:
https://github.com/dartondox/dox-postgres-native/security/advisories/new
Do not open a public issue for a security problem.
- We reply within 7 days.
- We fix confirmed issues.
- We publish a GitHub Security Advisory.
- We name the fix in the release notes.
This policy covers the dox_postgres_native package:
- The Dart code.
- The Rust code in
native/. - The prebuilt libraries in the GitHub releases. You can check them with
SHA256SUMS.
Other dartondox packages have their own SECURITY.md, or use the same process in their repo.