Security: imqueue/core

Security

Report a vulnerability

SECURITY.md

Security Policy

Reporting a vulnerability

If you believe you have found a security vulnerability in @imqueue/core (or any @imqueue/* package), please report it privately — do not open a public issue, pull request, or discussion for it.

Two private channels:

  • GitHub — use Security → Report a vulnerability on this repository to open a private advisory (preferred; it keeps the report and the fix coordinated in one place).
  • Email — support@imqueue.com with the details below.

Please include:

  • the affected package and version(s);
  • a description of the issue and its impact;
  • steps to reproduce, or a proof of concept, where possible.

What to expect

  • We aim to acknowledge a report within a few business days.
  • We'll confirm the issue, keep you updated on progress, and coordinate a fix and a disclosure timeline with you.
  • Once a fix is released we'll credit the reporter in the advisory unless you prefer to remain anonymous.

Supported versions

Security fixes land on the latest published release line of each @imqueue/* package on npm. Please make sure you can reproduce an issue against the current release before reporting.

Scope

The @imqueue framework is open source under GPL-3.0. This policy covers the code in the @imqueue/* packages. Vulnerabilities in third-party dependencies should be reported to those projects, though we're glad to help coordinate an upgrade.

Transport security

Connections to the redis broker are plaintext unless you ask for TLS. Set the tls option, or the IMQ_REDIS_TLS* environment variables, to encrypt every connection a queue opens — see the TLS section of the README. When TLS is configured there is no downgrade path: a broker that will not complete the handshake is reported as a connection failure rather than reached in the clear.

Two limits are worth stating plainly:

  • UDPClusterManager announces cluster membership over unauthenticated UDP broadcast. The announcements are neither encrypted nor signed, and the tls option does not apply to them.

    It does, however, bound what a forged announcement can achieve. Because brokers are announced by address, verification must be pinned to a name (servername) rather than left to compare against the address; a forged announcement then points a service at a host that cannot present a certificate signed by your authority, so it fails to connect rather than receiving traffic. Treat that as reducing an interception risk to a denial-of-service one, not as authenticating discovery.

  • rejectUnauthorized: false leaves a connection encrypted but unauthenticated, and therefore open to interception. The queue warns when it is set. Supply the ca for your private authority instead.

  • TLS material is read once, when the queue is constructed. A certificate rotated in place is not picked up by a running process, so rotation needs a restart — see the README for the CA-overlap procedure.

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: imqueue/core
Security
Report a vulnerability

SECURITY.md

Security Policy
Reporting a vulnerability
If you believe you have found a security vulnerability in @imqueue/core (or any
@imqueue/* package), please report it privately — do not open a public issue,
pull request, or discussion for it.
Two private channels:
  • GitHub — use Security → Report a vulnerability on this repository to open a
private advisory (preferred; it keeps the report and the fix coordinated in one
place).
  • Email — support@imqueue.com with the details below.
Please include:
  • the affected package and version(s);
  • a description of the issue and its impact;
  • steps to reproduce, or a proof of concept, where possible.
What to expect
  • We aim to acknowledge a report within a few business days.
  • We'll confirm the issue, keep you updated on progress, and coordinate a fix and a
disclosure timeline with you.
  • Once a fix is released we'll credit the reporter in the advisory unless you prefer
to remain anonymous.
Supported versions
Security fixes land on the latest published release line of each @imqueue/*
package on npm. Please make sure you can reproduce an issue against the current
release before reporting.
Scope
The @imqueue framework is open source under GPL-3.0. This policy covers the code
in the @imqueue/* packages. Vulnerabilities in third-party dependencies should be
reported to those projects, though we're glad to help coordinate an upgrade.
Transport security
Connections to the redis broker are plaintext unless you ask for TLS. Set the
tls option, or the IMQ_REDIS_TLS* environment variables, to encrypt every
connection a queue opens — see the TLS section of the README. When TLS is
configured there is no downgrade path: a broker that will not complete the
handshake is reported as a connection failure rather than reached in the clear.
Two limits are worth stating plainly:
  • UDPClusterManager announces cluster membership over unauthenticated UDP
broadcast. The announcements are neither encrypted nor signed, and the tls
option does not apply to them.
    It does, however, bound what a forged announcement can achieve. Because
brokers are announced by address, verification must be pinned to a name
(servername) rather than left to compare against the address; a forged
announcement then points a service at a host that cannot present a
certificate signed by your authority, so it fails to connect rather than
receiving traffic. Treat that as reducing an interception risk to a
denial-of-service one, not as authenticating discovery.
  • rejectUnauthorized: false leaves a connection encrypted but unauthenticated,
and therefore open to interception. The queue warns when it is set. Supply the
ca for your private authority instead.
  • TLS material is read once, when the queue is constructed. A certificate
rotated in place is not picked up by a running process, so rotation needs a
restart — see the README for the CA-overlap procedure.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: imqueue/core
Security
Report a vulnerability

SECURITY.md

Security Policy
Reporting a vulnerability
If you believe you have found a security vulnerability in @imqueue/core (or any
@imqueue/* package), please report it privately — do not open a public issue,
pull request, or discussion for it.
Two private channels:
  • GitHub — use Security → Report a vulnerability on this repository to open a
private advisory (preferred; it keeps the report and the fix coordinated in one
place).
  • Email — support@imqueue.com with the details below.
Please include:
  • the affected package and version(s);
  • a description of the issue and its impact;
  • steps to reproduce, or a proof of concept, where possible.
What to expect
  • We aim to acknowledge a report within a few business days.
  • We'll confirm the issue, keep you updated on progress, and coordinate a fix and a
disclosure timeline with you.
  • Once a fix is released we'll credit the reporter in the advisory unless you prefer
to remain anonymous.
Supported versions
Security fixes land on the latest published release line of each @imqueue/*
package on npm. Please make sure you can reproduce an issue against the current
release before reporting.
Scope
The @imqueue framework is open source under GPL-3.0. This policy covers the code
in the @imqueue/* packages. Vulnerabilities in third-party dependencies should be
reported to those projects, though we're glad to help coordinate an upgrade.
Transport security
Connections to the redis broker are plaintext unless you ask for TLS. Set the
tls option, or the IMQ_REDIS_TLS* environment variables, to encrypt every
connection a queue opens — see the TLS section of the README. When TLS is
configured there is no downgrade path: a broker that will not complete the
handshake is reported as a connection failure rather than reached in the clear.
Two limits are worth stating plainly:
  • UDPClusterManager announces cluster membership over unauthenticated UDP
broadcast. The announcements are neither encrypted nor signed, and the tls
option does not apply to them.
    It does, however, bound what a forged announcement can achieve. Because
brokers are announced by address, verification must be pinned to a name
(servername) rather than left to compare against the address; a forged
announcement then points a service at a host that cannot present a
certificate signed by your authority, so it fails to connect rather than
receiving traffic. Treat that as reducing an interception risk to a
denial-of-service one, not as authenticating discovery.
  • rejectUnauthorized: false leaves a connection encrypted but unauthenticated,
and therefore open to interception. The queue warns when it is set. Supply the
ca for your private authority instead.
  • TLS material is read once, when the queue is constructed. A certificate
rotated in place is not picked up by a running process, so rotation needs a
restart — see the README for the CA-overlap procedure.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: imqueue/core
Security
Report a vulnerability

SECURITY.md

Security Policy
Reporting a vulnerability
If you believe you have found a security vulnerability in @imqueue/core (or any
@imqueue/* package), please report it privately — do not open a public issue,
pull request, or discussion for it.
Two private channels:
  • GitHub — use Security → Report a vulnerability on this repository to open a
private advisory (preferred; it keeps the report and the fix coordinated in one
place).
  • Email — support@imqueue.com with the details below.
Please include:
  • the affected package and version(s);
  • a description of the issue and its impact;
  • steps to reproduce, or a proof of concept, where possible.
What to expect
  • We aim to acknowledge a report within a few business days.
  • We'll confirm the issue, keep you updated on progress, and coordinate a fix and a
disclosure timeline with you.
  • Once a fix is released we'll credit the reporter in the advisory unless you prefer
to remain anonymous.
Supported versions
Security fixes land on the latest published release line of each @imqueue/*
package on npm. Please make sure you can reproduce an issue against the current
release before reporting.
Scope
The @imqueue framework is open source under GPL-3.0. This policy covers the code
in the @imqueue/* packages. Vulnerabilities in third-party dependencies should be
reported to those projects, though we're glad to help coordinate an upgrade.
Transport security
Connections to the redis broker are plaintext unless you ask for TLS. Set the
tls option, or the IMQ_REDIS_TLS* environment variables, to encrypt every
connection a queue opens — see the TLS section of the README. When TLS is
configured there is no downgrade path: a broker that will not complete the
handshake is reported as a connection failure rather than reached in the clear.
Two limits are worth stating plainly:
  • UDPClusterManager announces cluster membership over unauthenticated UDP
broadcast. The announcements are neither encrypted nor signed, and the tls
option does not apply to them.
    It does, however, bound what a forged announcement can achieve. Because
brokers are announced by address, verification must be pinned to a name
(servername) rather than left to compare against the address; a forged
announcement then points a service at a host that cannot present a
certificate signed by your authority, so it fails to connect rather than
receiving traffic. Treat that as reducing an interception risk to a
denial-of-service one, not as authenticating discovery.
  • rejectUnauthorized: false leaves a connection encrypted but unauthenticated,
and therefore open to interception. The queue warns when it is set. Supply the
ca for your private authority instead.
  • TLS material is read once, when the queue is constructed. A certificate
rotated in place is not picked up by a running process, so rotation needs a
restart — see the README for the CA-overlap procedure.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: imqueue/core
Security
Report a vulnerability

SECURITY.md

Security Policy
Reporting a vulnerability
If you believe you have found a security vulnerability in @imqueue/core (or any
@imqueue/* package), please report it privately — do not open a public issue,
pull request, or discussion for it.
Two private channels:
  • GitHub — use Security → Report a vulnerability on this repository to open a
private advisory (preferred; it keeps the report and the fix coordinated in one
place).
  • Email — support@imqueue.com with the details below.
Please include:
  • the affected package and version(s);
  • a description of the issue and its impact;
  • steps to reproduce, or a proof of concept, where possible.
What to expect
  • We aim to acknowledge a report within a few business days.
  • We'll confirm the issue, keep you updated on progress, and coordinate a fix and a
disclosure timeline with you.
  • Once a fix is released we'll credit the reporter in the advisory unless you prefer
to remain anonymous.
Supported versions
Security fixes land on the latest published release line of each @imqueue/*
package on npm. Please make sure you can reproduce an issue against the current
release before reporting.
Scope
The @imqueue framework is open source under GPL-3.0. This policy covers the code
in the @imqueue/* packages. Vulnerabilities in third-party dependencies should be
reported to those projects, though we're glad to help coordinate an upgrade.
Transport security
Connections to the redis broker are plaintext unless you ask for TLS. Set the
tls option, or the IMQ_REDIS_TLS* environment variables, to encrypt every
connection a queue opens — see the TLS section of the README. When TLS is
configured there is no downgrade path: a broker that will not complete the
handshake is reported as a connection failure rather than reached in the clear.
Two limits are worth stating plainly:
  • UDPClusterManager announces cluster membership over unauthenticated UDP
broadcast. The announcements are neither encrypted nor signed, and the tls
option does not apply to them.
    It does, however, bound what a forged announcement can achieve. Because
brokers are announced by address, verification must be pinned to a name
(servername) rather than left to compare against the address; a forged
announcement then points a service at a host that cannot present a
certificate signed by your authority, so it fails to connect rather than
receiving traffic. Treat that as reducing an interception risk to a
denial-of-service one, not as authenticating discovery.
  • rejectUnauthorized: false leaves a connection encrypted but unauthenticated,
and therefore open to interception. The queue warns when it is set. Supply the
ca for your private authority instead.
  • TLS material is read once, when the queue is constructed. A certificate
rotated in place is not picked up by a running process, so rotation needs a
restart — see the README for the CA-overlap procedure.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: imqueue/core
Security
Report a vulnerability

SECURITY.md

Security Policy
Reporting a vulnerability
If you believe you have found a security vulnerability in @imqueue/core (or any
@imqueue/* package), please report it privately — do not open a public issue,
pull request, or discussion for it.
Two private channels:
  • GitHub — use Security → Report a vulnerability on this repository to open a
private advisory (preferred; it keeps the report and the fix coordinated in one
place).
  • Email — support@imqueue.com with the details below.
Please include:
  • the affected package and version(s);
  • a description of the issue and its impact;
  • steps to reproduce, or a proof of concept, where possible.
What to expect
  • We aim to acknowledge a report within a few business days.
  • We'll confirm the issue, keep you updated on progress, and coordinate a fix and a
disclosure timeline with you.
  • Once a fix is released we'll credit the reporter in the advisory unless you prefer
to remain anonymous.
Supported versions
Security fixes land on the latest published release line of each @imqueue/*
package on npm. Please make sure you can reproduce an issue against the current
release before reporting.
Scope
The @imqueue framework is open source under GPL-3.0. This policy covers the code
in the @imqueue/* packages. Vulnerabilities in third-party dependencies should be
reported to those projects, though we're glad to help coordinate an upgrade.
Transport security
Connections to the redis broker are plaintext unless you ask for TLS. Set the
tls option, or the IMQ_REDIS_TLS* environment variables, to encrypt every
connection a queue opens — see the TLS section of the README. When TLS is
configured there is no downgrade path: a broker that will not complete the
handshake is reported as a connection failure rather than reached in the clear.
Two limits are worth stating plainly:
  • UDPClusterManager announces cluster membership over unauthenticated UDP
broadcast. The announcements are neither encrypted nor signed, and the tls
option does not apply to them.
    It does, however, bound what a forged announcement can achieve. Because
brokers are announced by address, verification must be pinned to a name
(servername) rather than left to compare against the address; a forged
announcement then points a service at a host that cannot present a
certificate signed by your authority, so it fails to connect rather than
receiving traffic. Treat that as reducing an interception risk to a
denial-of-service one, not as authenticating discovery.
  • rejectUnauthorized: false leaves a connection encrypted but unauthenticated,
and therefore open to interception. The queue warns when it is set. Supply the
ca for your private authority instead.
  • TLS material is read once, when the queue is constructed. A certificate
rotated in place is not picked up by a running process, so rotation needs a
restart — see the README for the CA-overlap procedure.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: imqueue/core
Security
Report a vulnerability

SECURITY.md

Security Policy
Reporting a vulnerability
If you believe you have found a security vulnerability in @imqueue/core (or any
@imqueue/* package), please report it privately — do not open a public issue,
pull request, or discussion for it.
Two private channels:
  • GitHub — use Security → Report a vulnerability on this repository to open a
private advisory (preferred; it keeps the report and the fix coordinated in one
place).
  • Email — support@imqueue.com with the details below.
Please include:
  • the affected package and version(s);
  • a description of the issue and its impact;
  • steps to reproduce, or a proof of concept, where possible.
What to expect
  • We aim to acknowledge a report within a few business days.
  • We'll confirm the issue, keep you updated on progress, and coordinate a fix and a
disclosure timeline with you.
  • Once a fix is released we'll credit the reporter in the advisory unless you prefer
to remain anonymous.
Supported versions
Security fixes land on the latest published release line of each @imqueue/*
package on npm. Please make sure you can reproduce an issue against the current
release before reporting.
Scope
The @imqueue framework is open source under GPL-3.0. This policy covers the code
in the @imqueue/* packages. Vulnerabilities in third-party dependencies should be
reported to those projects, though we're glad to help coordinate an upgrade.
Transport security
Connections to the redis broker are plaintext unless you ask for TLS. Set the
tls option, or the IMQ_REDIS_TLS* environment variables, to encrypt every
connection a queue opens — see the TLS section of the README. When TLS is
configured there is no downgrade path: a broker that will not complete the
handshake is reported as a connection failure rather than reached in the clear.
Two limits are worth stating plainly:
  • UDPClusterManager announces cluster membership over unauthenticated UDP
broadcast. The announcements are neither encrypted nor signed, and the tls
option does not apply to them.
    It does, however, bound what a forged announcement can achieve. Because
brokers are announced by address, verification must be pinned to a name
(servername) rather than left to compare against the address; a forged
announcement then points a service at a host that cannot present a
certificate signed by your authority, so it fails to connect rather than
receiving traffic. Treat that as reducing an interception risk to a
denial-of-service one, not as authenticating discovery.
  • rejectUnauthorized: false leaves a connection encrypted but unauthenticated,
and therefore open to interception. The queue warns when it is set. Supply the
ca for your private authority instead.
  • TLS material is read once, when the queue is constructed. A certificate
rotated in place is not picked up by a running process, so rotation needs a
restart — see the README for the CA-overlap procedure.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: imqueue/core
Security
Report a vulnerability

SECURITY.md

Security Policy
Reporting a vulnerability
If you believe you have found a security vulnerability in @imqueue/core (or any
@imqueue/* package), please report it privately — do not open a public issue,
pull request, or discussion for it.
Two private channels:
  • GitHub — use Security → Report a vulnerability on this repository to open a
private advisory (preferred; it keeps the report and the fix coordinated in one
place).
  • Email — support@imqueue.com with the details below.
Please include:
  • the affected package and version(s);
  • a description of the issue and its impact;
  • steps to reproduce, or a proof of concept, where possible.
What to expect
  • We aim to acknowledge a report within a few business days.
  • We'll confirm the issue, keep you updated on progress, and coordinate a fix and a
disclosure timeline with you.
  • Once a fix is released we'll credit the reporter in the advisory unless you prefer
to remain anonymous.
Supported versions
Security fixes land on the latest published release line of each @imqueue/*
package on npm. Please make sure you can reproduce an issue against the current
release before reporting.
Scope
The @imqueue framework is open source under GPL-3.0. This policy covers the code
in the @imqueue/* packages. Vulnerabilities in third-party dependencies should be
reported to those projects, though we're glad to help coordinate an upgrade.
Transport security
Connections to the redis broker are plaintext unless you ask for TLS. Set the
tls option, or the IMQ_REDIS_TLS* environment variables, to encrypt every
connection a queue opens — see the TLS section of the README. When TLS is
configured there is no downgrade path: a broker that will not complete the
handshake is reported as a connection failure rather than reached in the clear.
Two limits are worth stating plainly:
  • UDPClusterManager announces cluster membership over unauthenticated UDP
broadcast. The announcements are neither encrypted nor signed, and the tls
option does not apply to them.
    It does, however, bound what a forged announcement can achieve. Because
brokers are announced by address, verification must be pinned to a name
(servername) rather than left to compare against the address; a forged
announcement then points a service at a host that cannot present a
certificate signed by your authority, so it fails to connect rather than
receiving traffic. Treat that as reducing an interception risk to a
denial-of-service one, not as authenticating discovery.
  • rejectUnauthorized: false leaves a connection encrypted but unauthenticated,
and therefore open to interception. The queue warns when it is set. Supply the
ca for your private authority instead.
  • TLS material is read once, when the queue is constructed. A certificate
rotated in place is not picked up by a running process, so rotation needs a
restart — see the README for the CA-overlap procedure.
 There aren't any published security advisories