Email security@keepass-web.app. Please don't report a vulnerability in a public issue, discussion, or pull request: until a fix ships, a public report shows attackers the way in before anyone can update.
Include as much of this as you can:
- the page or package affected, and the version shown in that page's footer
- steps to reproduce, or a proof of concept
- what an attacker could read, change, or take
Security fixes ship to everyone in a new release on the releases page. keepass-web.app begins serving each release once a maintainer has reviewed its deployment. If you run a downloaded copy, replace it with the latest release.
| KeePass Web release | Supported |
|---|---|
| Latest | ✅ |
| Earlier | ❌ |
This policy covers every repository in the keepass-web organization and the pages served at keepass-web.app. Report a flaw in a service KeePass Web relies on, such as Google's sign-in or GitHub itself, to that company.