Please report suspected vulnerabilities privately, not as a public issue. Use GitHub's private vulnerability reporting for this repository (the "Security" tab -> "Report a vulnerability"). Include a description, the affected version, and reproduction steps. We aim to acknowledge within a few days and will keep you posted on remediation.

git-cache-proxy is a shared, credentialed reader. Please read the "Security model" section of the README first: it documents the intended trust boundary (reachability), the single upstream credential, plain-HTTP serving, and the DoS knobs. Reports that contradict or extend that model are in scope. Known and documented behaviors - open defaults and an unbounded on-disk cache - are not vulnerabilities on their own.

Pre-1.0: fixes land on the latest release published to crates.io.