[Security Inquiry] Follow-up on Vulnerability Report for [backpex]

[xIllunight]

Hello,

I hope you're having a great week.

I am writing to follow up on a Security Advisory I submitted recently via GitHub regarding a potential vulnerability in backpex.

As I haven't heard back yet, I wanted to ensure the report was successfully delivered and hasn't been buried in notifications. Given the nature of the findings, I believe it warrants a quick review to ensure the safety of the project's users.

Looking forward to hearing from you.

Best regards,

Illunight
Security Researcher

[Flo0807]

Hello Illunight,

thank you for reaching out.

We did receive your Security Advisory submissions and have reviewed them. After investigation, we determined that the reported findings do not represent vulnerabilities in the Backpex library itself. The issues you identified are located in the /demo directory of the repository, which contains a Phoenix application used solely for demonstration, local development, and testing of the library.

Because the demo app is explicitly a sandbox environment (with seed data, intentionally open configurations, and example LiveResources), findings scoped to it do not affect downstream users of the library and therefore do not qualify as security vulnerabilities in Backpex.

If you come across an issue that affects the actual library code under /lib/backpex (i.e., something that could impact applications integrating Backpex), we would be happy to review it.