If you've found a security issue in terraform-provider-mxroute — credential leakage, an injection vector, a way to escalate privilege against the upstream API, or anything else where public disclosure could put users at risk — please do not open a public issue.
Instead, report it privately through GitHub's private vulnerability reporting. That gives maintainers a chance to investigate, ship a fix, and coordinate disclosure with you.
When you report, please include:
- What the vulnerability is and what an attacker can do with it.
- A minimal reproduction (a small terraform configuration or Go test that demonstrates the issue).
- The provider version and Go version you observed it on.
- Any suggested remediation if you have one.
In scope:
- The provider itself: client code under
internal/client/, resource and data source implementations underinternal/provider/, and the published binaries. - The release pipeline (signing, supply chain) as configured in this repository.
Out of scope:
- Vulnerabilities in the upstream MXroute API or panel — please report those directly to MXroute.
If you accidentally commit MXroute credentials to a public branch or PR, treat them as compromised: rotate the API key immediately in panel.mxroute.com/api-keys.php and force-push only after the key has been rotated.