Security fixes are provided for the latest release.

Use GitHub's private vulnerability reporting for this repository. Do not include production credentials, response bodies, private URLs, or customer data in an issue or proof of concept.

VaryProof is a local developer CLI, not a hosted fetch service. It accepts only HTTP(S), rejects URL userinfo and fragments, caps time/body size, blocks non-global destinations by default, and never follows redirects. --allow-private is explicit consent for a target you already trust.

DNS is checked before connecting, but the Python standard client resolves again during connection. A hostile short-TTL DNS service can create a rebinding race. Do not execute untrusted VaryProof configs on a privileged network.

Reports contain no body text, Cookie, Authorization, Set-Cookie, or arbitrary response headers. Body SHA-256 is retained only to compare exact bytes. Axis values appear in reports, so standard credential-bearing headers are rejected and secrets should never be used as custom axis values.