We provide security updates for the latest major version of rss-flow-cli.
| Version | Supported |
|---|---|
| 0.1.x | ✅ |
| < 0.1 | ❌ |
If you discover a security vulnerability within rss-flow-cli, please report it responsibly by contacting:
- Email: Rupam Ghosh
<hulo@crine.in>
Please do not open public GitHub issues for security vulnerabilities. We will acknowledge receipt of your vulnerability report within 48 hours and provide a timeline for remediation.
- Local Data Storage: All RSS feed subscriptions, article caches, and FTS5 search indexes are stored locally in your SQLite database (
~/.local/share/rss-flow/rss_flow.db). No telemetry or user data is collected. - Credentials & Tokens: Sync credentials (e.g., Miniflux tokens) are read from local configuration files (
~/.config/rss-flow/config.json) and transmitted exclusively over HTTPS. - HTML Sanitization: All incoming HTML content from RSS feeds and extracted web pages is parsed and sanitized to prevent terminal escape sequence injection.