Virlio is currently in Open Alpha and is actively developed.
Security fixes are applied to the latest deployed version. Older versions are not supported.
If you believe you have discovered a security vulnerability, please do not create a public GitHub Issue or Discussion.
Instead, contact the maintainers privately at virlio@iteebot.com with as much information as possible.
Please include:
- A detailed description of the vulnerability.
- Steps to reproduce the issue.
- The potential impact.
- Screenshots or proof of concept if applicable.
- Any suggested mitigations (optional).
We will acknowledge receipt of your report as soon as possible and investigate it promptly.
We kindly ask that you:
- Allow us reasonable time to investigate and fix the issue.
- Avoid publicly disclosing the vulnerability until a fix has been released.
- Avoid accessing or modifying data that does not belong to you.
- Avoid disrupting the availability of the service.
We appreciate responsible disclosure and will credit researchers who help improve Virlio's security, unless anonymity is requested.
Examples of security-related issues include, but are not limited to:
- Authentication bypass
- Authorization issues
- Privilege escalation
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- SQL Injection
- Remote Code Execution (RCE)
- Sensitive data exposure
- Insecure Direct Object References (IDOR)
- API security vulnerabilities
- OAuth implementation flaws
The following are generally considered out of scope:
- UI or cosmetic issues.
- Missing security headers without demonstrated impact.
- Denial-of-Service testing.
- Automated vulnerability scanner reports without verification.
- Vulnerabilities affecting third-party services outside of Virlio's control.
As Virlio is currently in Open Alpha, the platform is evolving rapidly.
Security improvements are continuously being made, and we appreciate responsible reports that help us build a more secure product.
Thank you for helping keep Virlio and its users safe.