Only the latest release gets fixes. Please update before reporting.

Please don't open a public issue. Use private vulnerability reporting instead. You'll get an answer within a few days.

Helpful to include: the version (proxy-scraper --version), the command, and what an attacker could do.

Things that count as a vulnerability here, for example:

• the rotating proxy server (--serve) being reachable from outside 127.0.0.1
• a proxy being able to break or bypass the TLS verification of the HTTPS test or of --serve
• crafted source lists or proxy answers that lead to code execution, path traversal or writing outside the results and data folders

Not a vulnerability: public proxies reading unencrypted traffic. That's how they work – never send sensitive data through them.

Every release ships the wheel and sdist together with a Sigstore bundle (*.sigstore.json), signed keylessly by the release workflow of this repository. To check that a file really came from it:

pipx install sigstore
sigstore verify github proxy_scraper_cli-1.33.1-py3-none-any.whl \
  --bundle proxy_scraper_cli-1.33.1-py3-none-any.whl.sigstore.json \
  --repository maximilianfeix/proxy-scraper

Workflows pin every action by commit SHA, install Python packages by hash, run CodeQL on every push to main, every pull request and once a week, and the OpenSSF Scorecard weekly. main is protected against force pushes and deletion.