Use GitHub's private vulnerability reporting: Security → Report a vulnerability on this repository. Please do not open a public issue for something exploitable.

Tell us what you can reproduce, on which PHP version, which integration and which storage driver, and what an attacker gets out of it. You will get a first reply within a week.

The latest 0.x minor. While the major is 0, fixes land in a new minor rather than a patch to the previous one.

Beacon has a public, unauthenticated endpoint that writes to your database. That is unavoidable — the browser has to be able to report — so the design assumes every field in a delivery is hostile:

• Nothing that decides identity is taken from the body. The address and user agent are observed by the server; the body only says which page and which metrics.
• Metrics outside a believable range are dropped, not clamped, so a caller cannot poison a percentile with a plausible-looking number.
• A delivery carries at most 20 events, and a vitals event with nothing usable in it is not stored at all.
• Every dimension a report can group by is checked against an allowlist before it reaches SQL.

• Anything that gets a value into storage that the mode says is not kept — an address in anonymous mode, a query string surviving into path.
• Anything that makes the visitor token reversible, or that ties one visitor across a salt rotation.
• SQL reaching the database through a path that is not a bound parameter or an allowlisted column name.
• An unbounded write: a single delivery that stores more rows than the cap.
• Anything the agent renders or evaluates from data it received.

• Volume from a script posting to your endpoint. It is public by necessity; put a rate limit in front of it if that matters to you, the same as any other public route.
• Inflated counts from forged deliveries. Beacon is analytics, not billing, and no client-side measurement can be made trustworthy.
• Data you chose to collect in full mode.