> ## Documentation Index
> Fetch the complete documentation index at: https://dylankenneally-react-native-ssh-sftp-96.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Learn how to report vulnerabilities, which versions are supported, and the project's security practices.

export const EditThisPage = ({filePath}) => {
  const REPO_EDIT_BASE_URL = 'https://github.com/dylankenneally/react-native-ssh-sftp/edit/master';
  return <div className="mt-10 rounded-2xl border border-zinc-950/10 bg-zinc-50 px-4 py-3 dark:border-white/10 dark:bg-white/5">
      <p className="m-0 text-sm text-zinc-600 dark:text-zinc-300">
        See something to improve?{' '}
        <a href={`${REPO_EDIT_BASE_URL}/${filePath}`}>Edit this page on GitHub</a>{' '}
        to suggest a change.
      </p>
    </div>;
};

This page summarizes the project's security policy and how to report vulnerabilities responsibly.

<CardGroup cols={2}>
  <Card title="Report a Vulnerability" icon="shield" href="#reporting-a-vulnerability">
    Contact the maintainer privately by [email](mailto:github+react-native-ssh-sftp-security@dylankenneally.com) instead of opening a public issue.
  </Card>

  <Card title="Supported Versions" icon="clock" href="#supported-versions">
    Check which release lines are currently supported before reporting or triaging an issue.
  </Card>
</CardGroup>

## Reporting a vulnerability

If you discover a security issue in this project:

1. Do not open a public GitHub issue.
2. Email [github+react-native-ssh-sftp-security@dylankenneally.com](mailto:github+react-native-ssh-sftp-security@dylankenneally.com).
3. Include:
   * A description of the vulnerability
   * Steps to reproduce it
   * The potential impact
   * A suggested fix, if you have one

<Warning>
  Please report security vulnerabilities privately by email rather than through public issues or discussions.
</Warning>

## Supported versions

The current support policy is:

| Version  | Supported |
| -------- | --------- |
| Latest   | Yes       |
| Previous | Yes       |
| Older    | No        |

## Host key verification

<Warning>
  This library does not currently verify the remote server's host key. On Android
  the underlying SSH session is configured with `StrictHostKeyChecking` disabled,
  and on iOS the host key is not pinned or checked. As a result, connections are
  susceptible to man-in-the-middle (MITM) attacks: a client cannot detect if it is
  talking to an impostor server.
</Warning>

Until host key verification is supported, treat this library as safe only on
networks you trust, and avoid transmitting highly sensitive data over
connections that could be intercepted. Practical steps to reduce risk:

* Prefer connecting over trusted, controlled networks (for example, a VPN).
* Use key-based authentication rather than passwords where possible, so credentials are never sent in a form a MITM could replay.
* Avoid connecting to servers reached over untrusted public networks.

Adding an API to supply known host keys (or an `onHostKey` verification
callback) is tracked as a future enhancement. See the project's
[issues](https://github.com/dylankenneally/react-native-ssh-sftp/issues) to
follow or contribute to that work.

## Security best practices

When using React Native SSH SFTP in your app:

* Keep dependencies up to date
* Prefer the latest stable version of the package
* Report suspected issues responsibly
* Follow OWASP guidance for SSH and SFTP-related operations

## What to avoid

* Do not disclose a vulnerability publicly before giving the maintainer time to investigate
* Do not use public GitHub issues for exploit details or reproduction steps
* Do not assume older unsupported versions will receive fixes

## Related resources

* [Contributing](/guides/contributing)
* [License](/guides/license)
* [GitHub Security Policy](https://github.com/dylankenneally/react-native-ssh-sftp/security)

<EditThisPage filePath="docs/guides/security.mdx" />