Security

How to report a vulnerability in OCX, and which versions receive security fixes.

Report a vulnerability

Email contact@michael-herwig.de rather than opening a public issue. Include:

• a description of the vulnerability
• the steps to reproduce it
• its potential impact

You get an acknowledgement within 48 hours. For critical issues, we aim to provide a fix or mitigation plan within 7 days.

Supported versions

Only the latest release receives security updates.