mirror of
https://github.com/feder-cr/invisible_playwright.git
synced 2026-06-07 08:35:12 +02:00
7f7a791564
The companion C++ patches repo at feder-cr/firefox-stealth was deleted 2026-05-19 and the source-of-truth fork was renamed from feder-cr/firefox to feder-cr/invisible-firefox. The branch stealth/150 on the renamed fork is now the single source of truth for all C++ patches. GitHub's auto-redirect is in effect for the old URLs but is not a forever guarantee, so update all references now. Updated: README.md × 2 hyperlinks (intro paragraph + license section) CONTRIBUTING.md × 3 references (quick links, scope, bug reports) SECURITY.md × 1 reference (out-of-scope vulnerabilities)
54 lines
2 KiB
Markdown
54 lines
2 KiB
Markdown
# Security Policy
|
|
|
|
## Supported versions
|
|
|
|
Only the latest release on `main` receives security fixes.
|
|
|
|
| Version | Supported |
|
|
|---------|-----------|
|
|
| latest | ✅ |
|
|
| older | ❌ |
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Please do not report security issues via public GitHub issues, discussions, or pull requests.**
|
|
|
|
Use one of the following private channels:
|
|
|
|
1. **GitHub Private Vulnerability Reporting** (preferred): open an advisory at https://github.com/feder-cr/invisible_playwright/security/advisories/new
|
|
2. **Email**: `federico.elia.majo@gmail.com` with subject prefix `[security][invisible_playwright]`
|
|
|
|
Please include:
|
|
|
|
- A clear description of the issue and impact
|
|
- Steps to reproduce (minimal repro preferred)
|
|
- The version of `invisible_playwright` and OS where it was observed
|
|
- Whether you have a suggested fix
|
|
|
|
## What to expect
|
|
|
|
- Acknowledgement of your report within **7 days**
|
|
- An initial assessment and tracking issue (private) within **14 days**
|
|
- Coordinated disclosure: a fix and public advisory are released together; reporters are credited unless they prefer to remain anonymous
|
|
|
|
## Scope
|
|
|
|
In scope:
|
|
|
|
- The Python wrapper `invisible_playwright` (this repo)
|
|
- The binary download/verification flow (SHA256 pinning, fetch endpoints)
|
|
- The CLI
|
|
|
|
Out of scope here (report to the relevant project):
|
|
|
|
- Vulnerabilities in the patched Firefox C++ source — open a private report at [feder-cr/invisible-firefox](https://github.com/feder-cr/invisible-firefox/security/advisories/new)
|
|
- Vulnerabilities in upstream Firefox / mozilla-central — report to Mozilla per https://www.mozilla.org/security/
|
|
- Vulnerabilities in third-party dependencies (`playwright`, `requests`, etc.) — report to those projects directly
|
|
|
|
## Out of scope
|
|
|
|
- Reports that the browser is detected by a specific anti-bot service — open a regular GitHub issue, this is a product-quality concern, not a security one
|
|
- Social engineering of maintainers
|
|
- Denial of service requiring physical access or local privileged access
|
|
|
|
Thank you for helping keep the project and its users safe.
|