Please do not open a public issue for a suspected vulnerability. Report it privately to me@ercan.dev with:
- the affected version and API;
- a minimal reproduction or malformed token, where safe to share;
- the security impact; and
- any suggested mitigation.
Do not include production Fernet keys, plaintext, or other credentials. Receipt will be acknowledged as soon as practical, and a coordinated disclosure timeline will be agreed after the report is validated.
Security fixes are provided for the latest released version. Applications should upgrade to the newest patch release and rotate affected keys when advised by a security notice.
This project implements Fernet version 0x80 using AES-128-CBC, PKCS#7-compatible padding, and HMAC-SHA256 as required by
the specification. It does not provide password-based key derivation, key storage, authorization, or replay prevention.