Security
Reporting a vulnerability
Report problems privately. Please do not open a public issue or pull request for a suspected vulnerability.
- wEdge: use GitHub private vulnerability reporting (the repository's Security tab). The security policy promises an acknowledgement within 7 days, an assessment within 14 days, and a fix or mitigation as soon as practical. Include the version, operating system, relevant configuration with secrets removed, reproduction steps and the impact. The project aims to disclose within 90 days or less.
- APIEdge: its security document says to report vulnerabilities privately to the OpenEdge Labs maintainers and not through public issues. It does not yet name a private channel, and GitHub private reporting was not turned on for that repository when checked on 9 November 2026. Until that is fixed, open a public issue that says only that you have a security report and asks for a private contact, without any detail.
- This website: private vulnerability reporting. See also security.txt.
Supported versions
From the wEdge security policy:
| Version | Security fixes |
|---|---|
| 0.2.x | Yes |
| 0.1.x | No |
Until 1.0, only the latest 0.x release of wEdge receives fixes. APIEdge has no release yet, so no supported-version policy applies.
No guarantees
Each project describes its own checks (for example scanners, tests and fuzzing) in its repository. No software is free of vulnerabilities; checks reduce risk, they do not remove it.