The latest revision on main is supported. This project is pre-1.0, so older revisions do not receive separate security fixes.

Please use GitHub's private vulnerability reporting for the repository rather than opening a public issue. Include the affected revision, reproduction steps, impact, and a minimal proof of concept with sensitive values removed. Maintainers will acknowledge a complete report as soon as practical and coordinate disclosure after a fix is available.

WebXRay is a local development and research tool. Its API can launch a browser toward HTTP and HTTPS addresses, including local or private-network targets. That capability is intentional and means the control plane must not be exposed to untrusted users.

The server binds to 127.0.0.1 by default. Cross-site browser mutations are rejected, scan starts are rate-limited, and concurrency, events, duration, listeners, and retained sessions are bounded. Setting WEBXRAY_ALLOW_REMOTE=1 only acknowledges the risk; it does not add authentication. Any remote deployment must use a trusted TLS reverse proxy with authentication and network access controls.

Do not place secrets in scanned URLs. URL credentials are rejected, fragments are removed, query values are redacted, and cookie values are discarded, but the destination itself still receives normal browser traffic.

GitHub Actions verifies formatting, linting, types, tests, production builds, browser journeys, and the container image. Dependabot monitors npm, Actions, and Docker dependencies. Run npm audit --audit-level=low and the checks in docs/RELEASE_CHECKLIST.md before a release.