Русский

Do not open a public issue. Use GitHub's private channel: the Security → Report a vulnerability tab. The conversation there is visible only to you and the maintainers until a fix is released.

Describe what you managed to do and how to reproduce it. The SDK version, the Go version and a minimal example help most.

Fixes are released for the latest minor version. While the version number starts with 0., the public API may change between minor versions.

These are worth reporting separately:

• A secret leaking into output. A webhook path and an OAuth token are full access to a portal. The SDK deliberately strips the URL out of its own error text; if a secret still ended up in an error message, in a log or in a panic, that is a vulnerability.
• Forging an application's inbound data. ParseOnAppInstallRequest, ParseAppRequest and AppAuth.VerifyApplicationToken parse what arrives from outside. A way to slip in someone else's DOMAIN, to bypass the application_token check or to make the SDK talk to an arbitrary host is a vulnerability.
• A client_secret escaping the oauth package.
• Any way to make the SDK send one portal's data to another.

• The portal's own permission errors (ACCESS_DENIED and the like) — that is Bitrix24 answering, not the SDK behaving.
• A secret your own code writes to a log after reading it from the environment.
• The absence of wrappers for specific REST methods: the call is universal by design, and a method name is an ordinary string.