We actively support the following versions of CrabCamera with security updates:

We take the security of CrabCamera seriously. If you discover a security vulnerability, please follow these guidelines:

DO NOT create a public GitHub issue for security vulnerabilities.

Instead, please report security issues privately using one of these methods:

1. GitHub Security Advisories (Preferred)

   • Go to the Security tab of this repository
   • Click "Report a vulnerability"
   • Fill out the advisory form with details

2. Direct Email

   • Send details to: michaelallenkuykendall@gmail.com
   • Include "SECURITY: CrabCamera" in the subject line

Please provide the following information in your report:

• Description: Clear description of the vulnerability
• Impact: What could an attacker accomplish?
• Reproduction: Step-by-step instructions to reproduce the issue
• Environment:
  • CrabCamera version
  • Operating system (Windows/macOS/Linux)
  • Rust version
  • Camera hardware (if applicable)
• Proof of Concept: Code or logs demonstrating the issue
• Suggested Fix: If you have ideas for remediation

We aim to respond to security reports according to the following timeline:

• Initial Response: Within 48 hours of report
• Triage: Within 7 days - confirm/deny vulnerability
• Resolution: Within 30 days for critical issues, 90 days for others
• Disclosure: Public disclosure after fix is released and users have time to update

We use the following criteria to classify vulnerabilities:

• Remote code execution via camera input
• Memory corruption leading to arbitrary code execution
• Unauthorized camera/audio access

• Denial of service via crafted input
• Memory exhaustion attacks
• Privacy leaks (unauthorized recording)

• Information disclosure
• Panic in safe Rust code
• Resource leaks

• Issues requiring local access
• Minor information leaks
• Performance degradation attacks

We believe in recognizing security researchers who help keep CrabCamera secure:

• Hall of Fame: Public recognition in our security acknowledgments
• CVE Assignment: For qualifying vulnerabilities
• Acknowledgment: Credit in release notes

glib 0.18.5 carries advisory GHSA-wrw7-89jp-8q8g (medium severity, unsoundness in VariantStrIter iterator impls). This dependency is a transitive requirement of webkit2gtk 2.0.2, which pins glib to "^0.18.0". No updated release of webkit2gtk that supports glib >= 0.20 is available on crates.io.

Mitigation: The VariantStrIter code path is exercised only when iterating variant child values. CrabCamera's webview usage on Linux (webkit2gtk) does not pass variant strings through the affected iterator methods. The alert is dismissed as a tolerable risk. Track the upstream issue: tauri-apps/webkit2gtk-rs#162

For critical vulnerabilities that are being actively exploited:

• Email: michaelallenkuykendall@gmail.com
• Subject: "URGENT SECURITY: CrabCamera - [Brief Description]"
• Response: Within 12 hours

1. Keep Updated: Always use the latest supported version
2. Permission Management: Only grant camera/audio permissions when needed
3. Trusted Sources: Only use CrabCamera from official releases

1. Dependencies: Regularly audit and update dependencies
2. Input Validation: Validate camera input and configuration
3. Memory Safety: CrabCamera is built with Rust for memory-safe execution

CrabCamera includes several built-in security features:

• Memory Safety: Built with Rust for memory-safe execution
• Permission System: Explicit camera/audio permission requests
• No Unsafe Code: Pure safe Rust in production paths
• Platform Integration: Uses native platform security (MediaFoundation, AVFoundation, V4L2)

For non-security related issues, please use:

• GitHub Issues: https://github.com/Michael-A-Kuykendall/crabcamera/issues
• GitHub Discussions: https://github.com/Michael-A-Kuykendall/crabcamera/discussions

This security policy is effective as of January 2026 and may be updated periodically.