Only the latest minor version receives security fixes.

Do not open a public issue for security vulnerabilities.

Instead, use GitHub's private vulnerability reporting:

1. Go to the Security tab
2. Click "Report a vulnerability"
3. Fill out the form

Or contact us directly.

• Description of the vulnerability
• Steps to reproduce
• Affected versions
• Potential impact
• Suggested fix (optional)

We'll credit you in the release notes (unless you prefer anonymity).

Security issues we care about:

• Remote code execution
• Path traversal (e.g., via include directives)
• Denial of service (e.g., parser hangs on malformed input)
• Memory safety issues
• Credential/secret exposure
• Supply chain attacks

Out of scope:

• Issues requiring physical access
• Social engineering
• Vulnerabilities in dependencies (report upstream, but let us know)

We use multiple layers of protection for our dependency supply chain:

All dependencies are audited using cargo-vet. We import trusted audits from:

• Mozilla
• Bytecode Alliance

Run cargo vet locally to verify all dependencies are audited.

Dependencies are checked against:

• RustSec advisory database (known vulnerabilities)
• License compliance (allowed licenses only)
• Banned crates list

Pull requests automatically check for:

• New vulnerable dependencies
• License violations
• Dependency confusion attacks

Software Bill of Materials (CycloneDX format) is generated for each release.

• detect-private-keys - Blocks commits containing private keys
• gitleaks - Comprehensive secret scanning with pattern matching

• clippy - Strict linting with security-relevant warnings
• cargo-deny - Dependency security checks

• All PRs require passing security checks
• Main branch is protected
• Automated dependency updates via Dependabot

• Secret scanning enabled
• Push protection enabled
• Dependabot alerts enabled
• Branch protection on main

We consider security research conducted in good faith to be authorized. We will not pursue legal action against researchers who:

• Act in good faith
• Avoid privacy violations
• Avoid data destruction
• Do not exploit issues beyond verification
• Report findings promptly