Security contact / active maintenance status?

[dev-fortress]

Hi, I'd like to report a potential security vulnerability I found in this project
(command execution class), but I don't see a SECURITY.md or Private Vulnerability
Reporting enabled here.

• Is this repository still actively maintained?
• Is there a preferred private channel (email, Security Advisory) to disclose
  vulnerability details responsibly?

I won't post technical details publicly until I hear back.

Thanks!

[si458]

meshcommander isnt really maintained anymore sadly!
however i do speak to @Ylianst so you can contact myself and him via the meshcentral security.md and we can look at things for you 👍
https://github.com/Ylianst/MeshCentral/security/policy

[dev-fortress]

Thanks a lot for pointing me in the right direction! I've just sent an email to Ylian and Simon following the MeshCentral security policy, confirming reporting eligibility and CVE possibility before sharing any technical details. I'll keep you posted on how it goes.

[Ylianst]

Thanks @dev-fortress. MeshCommander used to be sponsored by Intel (well, I used to work there and built it), but they canceled it. Always interested to see security issues and very much encourage security research, however these days, it's often a lot of AI reports.

[dgtlrift]

If MeshCommander is not really maintained, what is the preferred alternative?

meshcommander isnt really maintained anymore sadly! however i do speak to @Ylianst so you can contact myself and him via the meshcentral security.md and we can look at things for you 👍 https://github.com/Ylianst/MeshCentral/security/policy

[si458]

@dgtlrift the isnt any sadly (at least not that im aware of)
you could use meshcentral which supports the AMT stuff but its mainly designed for CIRA rather than LOCAL AMT

[dgtlrift]

CIRA is an option - MeshCentral is what I should evaluate?

[jsastriawan]

https://github.com/device-management-toolkit/console could be the alternative.