View Source Security

Supported versions

Only the latest 0.x release receives fixes. 0.1.x is unsupported.

Reporting a vulnerability

Please report security issues privately through GitHub's private vulnerability reporting. Do not open a public issue.

Include the library version, a description of the issue and, if possible, a minimal reproduction. You will get an acknowledgement within a few days and a fix or a written assessment as soon as one exists. Credit is given in the advisory and the changelog unless you prefer otherwise.

Scope

Dynamo signs requests with your AWS credentials and sends them to DynamoDB. Things that are in scope:

• credential handling (Dynamo.Credentials, the cache, IMDS/ECS lookups)
• request signing and endpoint selection
• anything that could make the library send data somewhere other than the configured endpoint, or log or expose credentials

Out of scope: vulnerabilities in DynamoDB itself, in req/finch/jason (report upstream), and misconfiguration of IAM policies in your account.