| Version | Supported |
|---|---|
| 2.x | ✅ |
| 1.x | ❌ |
If you discover a security vulnerability in Gebug, please report it by emailing the maintainers directly. Do not open a public issue.
Contact: Open an issue with label "security" or contact maintainers through GitHub.
Response Time: We aim to respond within 48 hours and provide a fix within 7 days for critical vulnerabilities.
When using Gebug:
- Never commit sensitive data in
.gebug/config.yaml - Use environment variables for secrets (they won't be copied to containers)
- Distroless runtime: The web UI Docker image uses distroless base (minimal attack surface)
- Network isolation: Use Docker networks to isolate debugging containers
- Local development only: Gebug is designed for local development, not production
- Keep dependencies updated: Run
go get -u ./...periodically
- Gebug runs containers with elevated privileges for debugging (by design)
- Delve debugger exposes a port that allows arbitrary code execution
- Hot-reload mounts your source code into containers
These are expected behaviors for a development tool and should NOT be used in production.