The following versions of kolay/xlsx-stream receive security updates:

Users on older releases are encouraged to upgrade to the latest 3.x. See UPGRADE.md for migration steps (all 3.x upgrades are backward-compatible).

If you discover a security vulnerability in kolay/xlsx-stream, please report it privately. Do not open a public GitHub issue.

Send a report to: turgutahmt@gmail.com

Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Affected version(s)
• Any relevant code snippets, exploits, or PoCs

You can expect:

• An acknowledgment within 72 hours
• An initial assessment within 7 days
• A coordinated disclosure timeline if the issue is confirmed

In-scope:

• The kolay/xlsx-stream package code
• The included S3 multipart upload implementation
• XML/ZIP construction logic that processes user-supplied data

Out-of-scope:

• Vulnerabilities in upstream dependencies (aws/aws-sdk-php, Laravel framework). Report those to the respective projects.
• Issues requiring administrator-level access to the host system.
• Denial of service via legitimate but very large inputs (the package is designed to handle millions of rows; if you find a configuration that causes unexpected memory growth, that's a bug not a vulnerability).

If you've responsibly reported a security issue, you'll be credited in the relevant CHANGELOG entry (with your permission).