LoopBack 3 has reached end of life. We are no longer accepting pull requests or providing support for community users. The only exception is fixes for critical bugs and security vulnerabilities provided as part of support for IBM API Connect customers. We urge all LoopBack 3 users to migrate their applications to LoopBack 4 as soon as possible. Learn more about LoopBack's long term support policy.

Security Policy

Edit this page

Page Contents

Security Policy

Security advisories

Security advisories can be found on the LoopBack website.

Reporting a vulnerability

If you think you have discovered a new security issue with any LoopBack package, please do not report it on GitHub. Instead, send an email to security@loopback.io with the following details:

Full description of the vulnerability.
Steps to reproduce the issue.
Possible solutions.

If you are sending us any logs as part of the report, then make sure to redact any sensitive data from them.