Only the latest release and the main branch get security fixes. The hosted planner at https://traceway.online runs the latest release.

Do not open a public issue, discussion, or pull request for a security problem.

Report it privately through GitHub: go to the Security tab and choose Report a vulnerability.

Include:

• what the problem is and what an attacker could do with it
• the steps or a proof of concept that shows it
• the affected URL, file, or version
• your name or handle, if you want credit

• We confirm that we got the report within 3 working days.
• We tell you whether we can reproduce it, and our plan, within 10 working days.
• We fix confirmed problems as fast as their impact requires, and we keep you updated.
• We publish an advisory once a fix is released, and credit you unless you ask us not to.

In scope: the code in this repository and the hosted planner at traceway.online.

Out of scope: the third-party routing engines and map tiles the planner calls, denial of service by traffic volume, reports from automated scanners with no demonstrated impact, and social engineering.

Test only against your own local install or your own account. Do not access other people's data, and do not degrade the service for others.