Please report security issues privately. Do not open a public issue, discussion or pull request.

• GitHub: use Report a vulnerability on the Security tab of the repository concerned (private vulnerability reporting).
• Email: hello@lastping.dev with "Security" in the subject.

This covers the public repositories and the hosted service at lastping.dev, app.lastping.dev, ping.lastping.dev and mcp.lastping.dev.

Please include what you found, how to reproduce it, and the impact you think it has. We will acknowledge your report, keep you updated while we fix it, and credit you when the fix is released if you would like that.

Please do not access other people's data, run denial-of-service or volume tests, or use social engineering while you investigate. Test against your own account.

Only the latest release of each public repository receives security fixes. Upgrade to the latest release before reporting where you can.

The hosted service is always the current version.