Only the latest release (or the main branch) receives security fixes.

Please do not report security vulnerabilities through public GitHub issues.

Use GitHub's private reporting instead: open the repository's Security tab and choose Report a vulnerability. Reports in English or Japanese are welcome.

Please include:

• The affected version or commit
• Steps to reproduce, or a proof of concept
• The impact you expect (for example, authentication bypass or access to audit records)

You can expect an initial response within 7 days. Once a fix is available, we will publish a GitHub Security Advisory and credit you unless you prefer to stay anonymous.

In scope:

• The web API and web GUI (authentication, authorization, input handling)
• Handling of the secrets in C:\ProgramData\FileAccessMonitor\ (jwt.key, initial-admin-password.txt, and chain.key, the key of the tamper-detection chains; on Linux the same files are in /var/lib/fileaccessmonitor/)
• The boundary between the web service (since 1.11 NT SERVICE\FileAccessMonitor, on Linux the user fileaccessmonitor) and the collector service (SYSTEM / root): ways for the web service account, or anyone on the machine, to make the collector do more than set up auditing and scan the monitored folders, or to read collector\key.secret
• The agent protocol (registration, the agent and collector credentials, batches and jobs)
• The PowerShell scripts in this repository

Out of scope:

• Running the web GUI over plain HTTP on an untrusted network. New installs use HTTPS by default since 1.9; installs upgraded from earlier versions stay on HTTP until switched (see the README).
• Attacks that require local Administrator or SYSTEM access to the server. Those accounts can read the Security event log directly.
• Vulnerabilities in Windows itself or in the bundled third-party libraries. Please report those upstream.

公開 Issue ではなく、リポジトリの Security タブ → Report a vulnerability（非公開報告）からご連絡ください。日本語でも構いません。