Only the latest release gets fixes. Please update before reporting.

Please don't open a public issue. Use private vulnerability reporting instead. You'll get an answer within a few days.

Helpful to include: the version (proxy-scraper --version), the command, and what an attacker could do.

Things that count as a vulnerability here, for example:

• the rotating proxy server (--serve) being reachable from outside 127.0.0.1
• a proxy being able to break or bypass the TLS verification of the HTTPS test or of --serve
• crafted source lists or proxy answers that lead to code execution, path traversal or writing outside the results and data folders

Not a vulnerability: public proxies reading unencrypted traffic. That's how they work – never send sensitive data through them.