Security fixes are applied to the latest release. Please make sure you are running the most recent version before reporting a problem.
Releases are published per component:
- Desktop —
desktop-v* - CLI —
cli-v* - Agent —
agent-v*
Please do not report security issues through public GitHub issues or discussions.
Instead, use GitHub's private reporting:
- Open the Security advisories page.
- Click Report a vulnerability.
If private reporting is unavailable to you, email fejdraus@gmail.com with the subject line CreatioHelper security.
Please include:
- A description of the issue and why you consider it a security problem
- Steps to reproduce, or a proof of concept
- Affected component (Desktop, CLI, Agent) and version
- Any suggested mitigation you are aware of
- An acknowledgement of your report within a few days.
- An assessment of the issue and, if confirmed, a fix in an upcoming release.
- Credit in the release notes, unless you prefer to stay anonymous.
CreatioHelper handles credentials for Creatio databases, Redis, SSH/SFTP targets and the agent API. Reports involving how these are stored, transmitted or logged are especially welcome.
Configuration files that the user themselves places on disk (for example settings.json containing their own connection strings) are not considered a vulnerability in the tool by default — but weaknesses in how the application protects, transmits or exposes that data are.