Security Policy

Supported versions

Security fixes are provided for the latest release of pg_checksums.

pg_checksums Supported
1.3.x Yes
< 1.3 No — upgrade

The supported PostgreSQL major versions are listed in the README and in the CI matrix. Please reproduce security reports on a currently supported PostgreSQL release.

Reporting a vulnerability

Do not open a public GitHub issue for a security problem.

Use GitHub’s private vulnerability reporting:

https://github.com/VictorNagibator/pg_checksums/security/advisories/new

If that page is unavailable, contact me at the address listed in META.json. Please do not publish details before a fix is available.

Include as much of the following as possible:

  • pg_checksums version: SELECT extversion FROM pg_extension WHERE extname = 'pg_checksums';
  • PostgreSQL version: SELECT version();
  • operating system and architecture;
  • a minimal reproduction, including SQL and any required DDL;
  • expected and actual behavior;
  • server logs, backtrace, or core dump details, if available.

Do not include real customer data, credentials, or production dumps. Replace sensitive values with synthetic ones.

Scope

Security-relevant issues include:

  • crashes or memory corruption caused by malformed or corrupted relation data;
  • bypassing the superuser requirement of database-level functions;
  • bypassing SELECT privilege checks or row-level security restrictions;
  • arbitrary file access or privilege escalation;
  • denial of service caused by an extension function.

Out of scope:

  • incorrect checksums caused by intentionally corrupted data (detecting corruption is the purpose of the extension);
  • performance problems;
  • problems in unsupported PostgreSQL or pg_checksums versions;
  • FNV-1a collisions. This is a non-cryptographic checksum, as documented.

What to expect

I will acknowledge the report, investigate it, and coordinate disclosure through a GitHub Security Advisory. Please allow reasonable time for a fix before publishing details.