Only the latest published version of ThorstenSauter.AspNetCore.Authentication.DeviceBoundSessions receives fixes. There are no maintained release branches.

Please report security issues privately through GitHub private vulnerability reporting. Do not open a public issue for anything security-sensitive.

When reporting, please include:

• a description of the vulnerability and its impact,
• the steps or a proof of concept needed to reproduce it,
• the package version and the configuration of AddDeviceBoundSession involved.

If the issue also affects the original implementation in dotnet/aspnetcore, please report it to Microsoft as well, following their security policy.

This is a small, single-maintainer project. Reports are acknowledged within a week, and you will be kept updated on the assessment and the fix. You will be credited in the release notes unless you prefer to stay anonymous. There is no bug bounty.