DevHub is before 1.0.0. Only the latest release gets security fixes.
| Version | Supported |
|---|---|
@rootnative/devhub, latest release |
Yes |
| Older releases | No |
Do not open a public issue for a security problem.
- Open the Security tab of this repository.
- Select Report a vulnerability and fill in the private form.
- Give the affected version and the steps to reproduce the problem.
We reply in 7 days or less. We publish a fix and an advisory after we confirm the report.
DevHub runs on the developer's machine. It reads build files, runs adb, emulator, xcrun, eas-cli, and bundletool, and installs app binaries on simulators and emulators. These reports are in scope:
- A build file or a download that writes outside the DevHub store, for example through a path in an archive.
- A value from a build file, a project config, or an EAS record that changes a command DevHub runs.
- A download that DevHub installs without a check of its SHA-256 hash.
- A credential, such as an EAS token, that DevHub writes to a log or to its store.
The apps that you install with DevHub are out of scope. DevHub does not check what an app does.