This project takes security seriously —this is meant literally —not like some companies claim after a breach or other security incident.

The attack surface of testssl.sh is quite small and thus there should not be any serious blunders. We followed recommended security practices, e.g. validate inputs and more.

However this project was made by humans and despite our dedication and diligence there could be still security bugs. If you find one and the impact is not low, please use Responsible Disclosure, see github docs and report them privately . If you happen to have a PoC, it will be much appreciated but it is not mandatory. Using Full Disclosure might be a problem everywhere where testssl.sh is being used -- just for for CLI users, maintainers of CI/CD or monitoring environment or for people using testssl.sh as a scanner on their website.

Also keep in mind that the maintainers here have a professional attitude but this project is volunteer work.

"Create new Issue" --> "Report a security vulnerability" . Then on the LHS you should see "Advisory" which you need to fill out. That stays private until we fixed your point or, if your point has no impact, disregard it.

As said in the Readme.md we only support n-1 versions , n being the branch/minor version:

For x (patch version) we expect your report to refer to the latest release. For the rolling release version (*dev) please refer to the latest and greatest @ github.