Security Policy

This is the security policy for the WebDyne::Cloudflare distribution and @webdyne/webdyne-cloudflare npm package.

This policy was updated on 2026-09-26.

Reporting a Security Vulnerability

Please report security vulnerabilities via GitHub private vulnerability reporting for this repository:

https://github.com/aspeer/pm-WebDyne-Cloudflare/security/advisories/new

GitHub private vulnerability reporting is enabled for this repository and is the preferred reporting point.

If you cannot use GitHub, report the issue privately by email to the current project maintainer:

Andrew Speer andrew.speer@isolutions.com.au

Please do not report security vulnerabilities through public GitHub issues, public pull requests, RT, mailing lists, social media, chat channels, or other public forums.

Please include enough detail to reproduce and assess the issue, including:

• the affected WebDyne::Cloudflare or npm package version
• the affected Perl, Node.js, and Workers runtime versions, if relevant
• a proof of concept, test case, or reproduction steps
• relevant logs, code snippets, configuration, or request/response examples
• whether the issue is known to be actively exploited
• whether you want public credit when the issue is disclosed

Do not include passwords, tokens, private keys, personal data, or other sensitive information in the report unless it is strictly necessary and safe to share with the maintainer.

If you would like help triaging the issue, need CVE coordination, cannot reach the maintainer, or believe the issue is being actively exploited, you may also copy the CPAN Security Group (CPANSec):

cpan-security@security.metacpan.org

For signs of a compromised CPAN/PAUSE account, contact the PAUSE administrators privately:

pause-admin@perl.org

Supported Versions

Security fixes are normally made against the latest WebDyne::Cloudflare release. Older releases are not routinely supported unless the maintainer decides a backport is practical and necessary for downstream users.

If this policy or the latest release is more than two years old, check for a newer release on CPAN, npm, or in the main GitHub repository before relying on the contact and support information here.

Handling and Disclosure

The maintainer will aim to acknowledge security reports as soon as practical, investigate the report, and coordinate a fix and public disclosure where appropriate. WebDyne::Cloudflare is maintained by a volunteer maintainer, so exact response times cannot be guaranteed.

Please do not publicly disclose the vulnerability, exploit details, patches, or mitigation advice until a coordinated disclosure date has passed or the issue has been made public by the maintainer or CPANSec.

Scope

This policy applies to vulnerabilities in WebDyne::Cloudflare itself. Vulnerabilities in Cloudflare services, WebDyne, ZeroPerl, or other dependencies should be reported to their respective maintainers. Installation problems, general bugs, feature requests, documentation issues, and non-security support questions should use the normal public GitHub issue tracker.

This policy is based on guidance from the CPAN Security Group:

https://security.metacpan.org/docs/guides/security-policy-for-authors.html