If you discover a security vulnerability in mod_pagespeed 2.1, please report it responsibly by emailing security@modpagespeed.com. Do NOT open a public GitHub issue.

We will acknowledge your report within 72 hours and work with you to understand and address the issue.

The following components are in scope for security reports:

• pagespeed-optimizer daemon and the nginx serving module (image optimization, HTML rewriting, cache subsystem, management HTTP API)
• ASP.NET Core middleware and NuGet packages
• Web console (the /console/ UI)

Reports for the Apache module (the We-Amp/mod_pagespeed repository) are covered by this same policy and address.

Third-party dependencies are out of scope. If you find a vulnerability in a dependency, please report it to the upstream maintainer and notify us so we can assess impact.

Only the latest release of the mod_pagespeed 2.1 line receives security updates. Users on older versions should upgrade to receive fixes.

We follow a 90-day coordinated disclosure timeline. Once a vulnerability is reported:

1. We confirm receipt within 72 hours.
2. We investigate and develop a fix.
3. We coordinate a release within 90 days of the initial report.
4. After the fix is released, the reporter may publish details.

If you would like to be credited for your report, let us know and we will include your name (or alias) in the release notes.

• Email: security@modpagespeed.com
• Company: We-Amp B.V., Castricum, The Netherlands