The latest released version of ccdrop is the only version that receives security updates. Please always upgrade to the latest version before reporting a vulnerability.
| Version | Supported |
|---|---|
| latest | ✅ |
| < latest | ❌ |
Please do not file a public issue. Send security reports privately:
- Email: open a private security advisory at https://github.com/ezzcodeezzlife/ccdrop/security/advisories/new
- Or DM via GitHub: https://github.com/ezzcodeezzlife
Please include:
- A clear description of the vulnerability and impact.
- Steps to reproduce or a proof-of-concept.
- The version of
ccdrop, Node.js, and OS. - Any known workarounds.
We aim to acknowledge reports within 72 hours and ship a fix or mitigation as soon as practical.
The public relay (https://claude-chat-share.vercel.app) is RAM-only: sessions are wiped the instant a download completes, and otherwise expire within 15 minutes. No logs are retained.
If your threat model requires that no byte ever touches infrastructure you do not control, run your own relay:
npx ccdrop server...or deploy api/index.js to Vercel / any Node 18+ host and point ccdrop at it with -s <url>.