Please do not open a public issue for security problems.

Report it privately through GitHub instead: go to the Security tab of this repository and click Report a vulnerability (direct link). Include what you found, how to reproduce it, and the impact you expect.

This is a personal project maintained in spare time. You can expect an acknowledgement within a week. Fixes are released as soon as practical, and you'll be credited in the advisory unless you prefer otherwise.

Of particular interest: captured page content executing inside ZProxy's own UI, scope rules that fail open, captured secrets leaking to storage or logs beyond what the docs describe, and permission misuse. See docs/SECURITY.md and docs/THREAT_MODEL.md.

Only the latest version on the main branch receives security fixes.