dnspatch is in the v0.x series. Security fixes go into the latest release only, so please upgrade to the newest version before reporting.

Do not open a public issue for a vulnerability.

Use GitHub's private reporting: open the Security tab of the affected repository and choose Report a vulnerability. Only the maintainers see the report.

Please include the affected version, a description of the impact and steps to reproduce. You will get an answer within a few days, and the fix and the disclosure are coordinated with you through the same private thread.

Credentials that leaked into a config, a log or an issue are not a vulnerability in dnspatch. Revoke them at the provider first.