Your trust matters. So does the way we protect it.
This page explains how to report vulnerabilities responsibly, what we maintain, and how we handle security concerns.
Important
Found a possible security issue? Please report it privately first.
Do not publish exploitable details, proof-of-concept exploits, credentials, or private user data in public GitHub issues, pull requests, discussions, or social media.
- Preferred — GitHub private vulnerability reporting: If enabled for this repository, use Report a vulnerability →. This is the preferred way to share details privately with maintainers.
- If that option is unavailable: Check the maintainer's GitHub profile for an appropriate private contact method. If you cannot find one, you may open a new issue only to request a private reporting channel—do not include vulnerability details or evidence in that public issue.
Clear reports help us understand the impact and investigate safely:
| Detail | Helpful information |
|---|---|
| Affected area | Android, desktop, TV, Wear OS, website, shared core, or Listen Together |
| Version | Release version, commit SHA, and affected OS/device where relevant |
| Impact | What an attacker could do, what data or capability is at risk |
| Reproduction | Minimal steps or a safe proof of concept using your own test setup |
| Evidence | Redacted logs, screenshots, relevant code paths, or error messages |
| Mitigation | Any workaround or potential fix you have identified |
Please remove passwords, tokens, cookies, API keys, personal information, and other secrets from reports. Do not send real users' data.
We focus security maintenance on the current codebase and the most recent published builds.
| Version / channel | Security maintenance |
|---|---|
| Latest published release | ✅ Priority for security fixes, when releases are available |
main branch |
🧪 Active development; fixes may land here before a release |
| Older releases / builds | |
| Unofficial forks / modified distributions | ➖ Maintained by their respective distributors |
Recommendation: Use the latest official release from GitHub Releases. Development builds can contain unfinished changes; availability of source code does not mean every platform has a published installer.
Vyon spans several platforms and services. Security reports are welcome for vulnerabilities in code or infrastructure controlled by this project, including:
| Component | Examples of relevant issues |
|---|---|
| Android / Android TV / Wear OS | Unsafe exported components, unintended data exposure, insecure local storage |
| Desktop (Windows, macOS, Linux) | Unsafe file handling, privilege boundaries, command execution, insecure updates |
| Shared core & integrations | Sensitive data leakage, token handling, untrusted content processing |
| vyon.live website | Project-owned website vulnerabilities such as cross-site scripting or exposed secrets |
| Listen Together services | Unauthorized room access, authentication/authorization flaws, abuse of room state or APIs |
| Build & release pipeline | Project-controlled packaging or distribution flaws that could compromise users |
- Routine feature bugs, styling problems, or ordinary crashes without a security impact — please use GitHub Issues.
- Vulnerabilities exclusively in YouTube, YouTube Music, Google, Discord, Last.fm, or other third-party services. Report those to the relevant provider.
- Issues in unofficial builds, forks, or third-party deployments that cannot be reproduced in Vyon's maintained code.
- Reports based only on an automated scan without a verifiable security impact.
If an upstream dependency creates a real security risk for Vyon users, please still let us know privately.
We appreciate security researchers who help improve Vyon while keeping users safe.
Please do:
- Test with accounts, devices, files, rooms, and servers you own or are authorized to use.
- Keep tests proportional and non-disruptive; stop once you have enough evidence.
- Give maintainers a reasonable opportunity to investigate and coordinate a fix before public disclosure.
- Respect privacy and promptly stop testing if you encounter data that isn't yours.
Please don't:
- Access, copy, change, or disclose someone else's data.
- Run denial-of-service tests, spam services, perform social engineering, or disrupt real users.
- Attempt persistence, lateral movement, destructive exploits, or attacks on third-party systems.
- Publicly post a working exploit before coordinating disclosure.
This guidance welcomes good-faith, authorized research; it is not permission to test systems or accounts you don't control.
Private report
↓
Review & reproduce
↓
Assess severity and impact
↓
Develop & validate a fix
↓
Release / advisory when appropriate
We aim to acknowledge useful reports, investigate credible findings, and prioritize fixes by actual risk. Response times, release dates, and backports are not guaranteed. We may ask for more details if we cannot reproduce a report.
When appropriate, we will coordinate public disclosure after users have a reasonable opportunity to update. Please avoid publishing sensitive technical details until that coordination has taken place.
If you would like to be credited for a verified, responsibly disclosed finding, mention the name or handle you want us to use in your private report. Recognition is subject to your consent and the circumstances of the report. Rewards or bounties are not promised.
A few habits make a real difference:
- Download from trusted sources. Prefer official GitHub Releases and links from vyon.live.
- Keep Vyon and your operating system updated. Security fixes may require installing a newer version.
- Protect your credentials. Never post API keys, tokens, session cookies, configuration secrets, or signing keys in an issue or screenshot.
- Be careful with custom integrations and servers. Only connect to services and music sources you trust.
- Act on suspected compromise. Stop using the affected integration, revoke exposed credentials with their provider, and submit a private report if you believe Vyon contributed to the exposure.
Note
Vyon is an independent, open-source music player. It is not affiliated with or endorsed by Google or YouTube. The security of third-party platforms and services is governed by their own policies.
