Skip to content

Repository navigation

Security: Sydney-Elvis/M3Undle

Security

Report a vulnerability

SECURITY.md

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in M3Undle, please report it privately using GitHub's private vulnerability reporting:

https://github.com/Sydney-Elvis/M3Undle/security/advisories/new

Please include:

  • Description of the issue
  • Steps to reproduce
  • Affected endpoints (e.g. M3U, XMLTV, HDHR)
  • Any relevant logs or requests

What to Expect

  • I will acknowledge receipt within 48 hours
  • I will work to validate and address the issue as quickly as possible
  • You may be asked for additional details during investigation

Disclosure Policy

Please do not publicly disclose the issue until:

  • A fix has been released, or
  • We agree on a disclosure timeline

Insiders Edition

M3Undle Insiders gives contributors and early adopters access to work intended for the public release before it is fully stable and vetted. It is not a permanent separate tier — features move to the public edition once ready.

Security fixes are never held for Insiders. They ship to the public edition on the same release as any other fix, subject to the disclosure policy above.

Scope

This project includes:

  • IPTV proxy endpoints (M3U, XMLTV, HDHR)
  • Web UI and API endpoints
  • Authentication and access control

Notes

This is an early-stage project. Security improvements are ongoing, and responsible disclosure is appreciated.

There aren't any published security advisories