Skip to main content
This page summarizes the project’s security policy and how to report vulnerabilities responsibly.

Report a Vulnerability

Contact the maintainer privately by email instead of opening a public issue.

Supported Versions

Check which release lines are currently supported before reporting or triaging an issue.

​
Reporting a vulnerability

If you discover a security issue in this project:
  1. Do not open a public GitHub issue.
  2. Email github+react-native-ssh-sftp-security@dylankenneally.com.
  3. Include:
    • A description of the vulnerability
    • Steps to reproduce it
    • The potential impact
    • A suggested fix, if you have one
Please report security vulnerabilities privately by email rather than through public issues or discussions.

​
Supported versions

The current support policy is:

​
Host key verification

This library does not currently verify the remote server’s host key. On Android the underlying SSH session is configured with StrictHostKeyChecking disabled, and on iOS the host key is not pinned or checked. As a result, connections are susceptible to man-in-the-middle (MITM) attacks: a client cannot detect if it is talking to an impostor server.
Until host key verification is supported, treat this library as safe only on networks you trust, and avoid transmitting highly sensitive data over connections that could be intercepted. Practical steps to reduce risk:
  • Prefer connecting over trusted, controlled networks (for example, a VPN).
  • Use key-based authentication rather than passwords where possible, so credentials are never sent in a form a MITM could replay.
  • Avoid connecting to servers reached over untrusted public networks.
Adding an API to supply known host keys (or an onHostKey verification callback) is tracked as a future enhancement. See the project’s issues to follow or contribute to that work.

​
Security best practices

When using React Native SSH SFTP in your app:
  • Keep dependencies up to date
  • Prefer the latest stable version of the package
  • Report suspected issues responsibly
  • Follow OWASP guidance for SSH and SFTP-related operations

​
What to avoid

  • Do not disclose a vulnerability publicly before giving the maintainer time to investigate
  • Do not use public GitHub issues for exploit details or reproduction steps
  • Do not assume older unsupported versions will receive fixes
Last modified on July 4, 2026