Only the latest published release receives security fixes.
Please use GitHub's Report a vulnerability / Private Vulnerability Reporting feature for this repository. Do not open a public issue for path-boundary bypasses, unintended deletion, privilege escalation, command injection, or sensitive log exposure.
Include:
- CDriveCare version and Windows version;
- the affected cleanup rule;
- a minimal reproduction using disposable test data;
- the expected and actual path boundary;
- whether a junction, symlink, mount point, race, or environment-variable change is involved.
Never upload logs that expose usernames, personal paths, machine names, or private file names without redacting them first.
High-priority security issues include:
- deletion outside the selected rule root;
- traversal through a Reparse Point;
- deletion of a protected system or personal directory;
- command argument injection;
- reporting a failed cleanup as successful;
- writing logs outside the documented per-user log directory.
- accepting update metadata or download links outside the fixed CDriveCare GitHub repository;
- publishing a Release whose tag, executable version, checksums, or source commit do not match.