gmacFTP handles server addresses, usernames, passwords, local paths, and file transfers, so security issues should be treated carefully.

The project is pre-1.0. Security fixes are provided for the latest published release and the main branch; older releases should be upgraded.

Report vulnerabilities privately through GitHub Security Advisories.

If private advisories are not available yet, open a minimal issue that describes the class of problem without including credentials, server names, logs with tokens, or private file paths. Maintainers can then coordinate a safe disclosure path.

Do not attach:

• Real FTP/SFTP passwords
• Private connection export files
• Full local home-directory screenshots
• Production host lists
• Keychain or vault files
• Logs containing credentials, tokens, or private paths

Use localhost test servers or placeholder domains such as example.com when reproducing issues.

gmacFTP ships macOS-only. The release lockfile currently has three known vulnerability advisories, all explicitly reviewed:

• macOS dependency, vulnerable operation not used. rsa 0.10.0-rc.18 (RUSTSEC-2023-0071, "Marvin Attack", MEDIUM 5.9) is pulled in transitively by russh and has no fixed release. gmacFTP rejects built-in RSA private keys before authentication, so the crate performs no remotely observable RSA private operation. RSA authentication remains available via SSH Agent, which delegates signing to the system agent; RSA server host keys use public verification only. Built-in Ed25519/ECDSA key authentication is unaffected. CI accepts this advisory until russh can remove or replace the dependency.
• Linux-only. quick-xml 0.39.4 (RUSTSEC-2026-0194 and RUSTSEC-2026-0195, both HIGH 7.5) is pulled by Slint's Wayland/accessibility dependency graph. It is absent from both macOS target graphs (cargo tree -i quick-xml --target aarch64-apple-darwin and the equivalent x86_64 command return nothing), so these parsers are not compiled into the distributed app.

The dependency audit also reports informational maintenance/unsoundness warnings. The GTK3, X11 and Wayland group (atk, gdk, gtk, glib, bincode, and proc-macro-error) is absent from the macOS target. paste is a proc-macro/build dependency. rustybuzz 0.20.1 and ttf-parser 0.25.1 are macOS dependencies of Slint's SVG/font rendering stack and are currently marked unmaintained by RustSec (RUSTSEC-2026-0206 and RUSTSEC-2026-0192). These warnings have no known vulnerability entry and do not change cargo audit's exit status; they remain tracked for a future Slint upgrade. The formerly direct, unmaintained rustls-pemfile dependency has been removed; FTPS identities are parsed through the maintained PEM API already exposed by Rustls.

RUSTSEC-2026-0186 is fixed by pinning memmap2 0.9.11; the lockfile also contains the non-yanked crypto-bigint 0.7.5. CI ignores only the three reviewed vulnerability IDs above, so every new vulnerability fails the audit gate.