3x-ui/subproject/Xray-core-main/SECURITY.md

# Security Policy

If you found an issue related to security vulnerability or protocol-identification problem, please report it to us via "[Report a vulnerability](https://github.com/XTLS/Xray-core/security/advisories/new)" privately, instead of publish it publicly before we release the fixed version.

Thanks for your contribution to the FREE Internet!
Fixes & Changes: 1. Fixed XPadding Placement Dropdown: - Added the missing `cookie` and `query` options to `xPaddingPlacement` (`stream_xhttp.html`). - Why: Previously, users wanting `cookie` obfuscation were forced to use the `header` placement string. This caused Xray-core to blindly intercept the entire monolithic HTTP Cookie header, failing internal padding-length validations and causing the inbound to silently drop the connection. 2. Fixed Uplink Data Placement Validation: - Replaced the unsupported `query` option with `cookie` in `uplinkDataPlacement`. - Why: Xray-core's `transport_internet.go` explicitly forbids `query` as an uplink placement option. Selecting it from the UI previously sent a payload that would cause Xray-core to instantly throw an `unsupported uplink data placement: query` panic. Adding `cookie` perfectly aligns the UI with Xray-core restrictions. ### Related Issues - Resolves #3992 2026-04-06 12:00:43 +00:00			`# Security Policy`

			`If you found an issue related to security vulnerability or protocol-identification problem, please report it to us via "[Report a vulnerability](https://github.com/XTLS/Xray-core/security/advisories/new)" privately, instead of publish it publicly before we release the fixed version.`

			`Thanks for your contribution to the FREE Internet!`