This library has serious security vulnerabilities

[riccardobl]

I tried to contact the developer in private but I had no success.
Can anyone with write access to this repository please enable security reports so that i can report them privately?

[hoornet]

Did you manage to contact anyone?
I'm getting worried after recent increased AI assisted attacks

[riccardobl]

Did you manage to contact anyone? I'm getting worried after recent increased AI assisted attacks

Nope, I'm sorry... I tried my best. I strongly suggest to avoid using this library, if this is the way it is being maintained.

[hoornet]

Adding a second voice from a downstream client — Vega (hoornet/vega) ships NDK to desktop users on Linux, Windows and macOS.

Regardless of what @riccardobl has found, the gap he's pointing at is real and cheap to close: this repo has no SECURITY.md and private vulnerability reporting isn't enabled, so there is currently no way to report anything here except in public. Enabling GitHub's private reporting is two clicks in Settings → Security, and it costs nothing if it's never used.

@pablof7z — would you be willing to turn it on? Happy to open a PR adding a SECURITY.md pointing at it if that helps.