VDO.Ninja is maintained as a live web application and open source project. Security fixes are handled on a best-effort basis for the current hosted service, the active development branch, and release branches when a fix is practical.

Older branches, forks, self-hosted deployments, browser extensions, third-party integrations, and downstream packages may not receive the same updates. This policy does not create a support contract, service-level agreement, bounty program, or obligation to fix every report.

Please do not open a public issue for a suspected security vulnerability.

Use GitHub private vulnerability reporting for this repository when available:

https://github.com/steveseguin/vdo.ninja/security/advisories/new

If that form is unavailable, use the contact options on https://vdo.ninja to ask for a private security contact without sharing exploit details publicly.

Helpful reports usually include:

• a short description of the issue and potential impact;
• steps to reproduce, including affected URL parameters, pages, branches, or commits;
• whether user data, room access, authentication, or browser permissions are involved;
• any known workaround or mitigation.

Please allow time for review before public disclosure. Reports are reviewed on a best-effort basis, and response times may vary.

When testing, only use accounts, rooms, devices, networks, and data that you own or have explicit permission to test. Do not disrupt the hosted service or other users.

The following are generally out of scope unless they demonstrate a concrete security impact:

• general bug reports or feature requests;
• social engineering, phishing, spam, or physical attacks;
• denial-of-service testing against hosted infrastructure;
• reports that require access to an already-compromised account, device, browser, or network;
• scanner output without a reproducible exploit or practical impact.