This repository holds the Windows GUI (WinHTTrack). The crawler engine lives in xroche/httrack, which keeps its own security policy, so report a bug in the engine there. If you cannot tell which one you are looking at, report it here and we will route it.

Report privately, not in a public issue or PR: use GitHub private advisories or email roche@httrack.com (alternate: xroche at gmail dot com).

Include the WinHTTrack version and the Windows version, a concrete reproduction (the steps or project settings, a sample page or server response, or a small proof of concept), and what an attacker gains. We'll acknowledge it and keep you posted. Please allow time for a release before disclosing publicly.

How we ship the software counts too. Tell us about an installer that carries a signature it should never have been given, or a binary whose contents do not match the source it claims to come from. SIGNING.md explains how we sign a release and how you can check one yourself.

Fixes land on master and ship in the next release; older releases aren't maintained. Confirm against current master when you can.

Scanners and LLMs are fine, but only send reports you have verified yourself. A confirmed, reproducible issue is worth our time; a plausible one that doesn't reproduce is not, and will be closed. If a report is AI-assisted, say so.