Do not open public issues for security vulnerabilities.

Report privately via GitHub Security Advisories

• Description of the vulnerability
• Steps to reproduce
• Proof of concept (code, commands, screenshots)
• Affected versions
• Potential impact (DoS, code execution, data leak, etc.)

We run automated security scanning in CI:

• cargo audit — Rust dependency vulnerabilities
• cargo deny — license and dependency policy checks
• trivy — SBOM vulnerability scanning
• gitleaks — secrets detection
• clippy — Rust static analysis (SAST)

Check that your finding is not already detected. Also review our VEX statements for known CVEs marked as not applicable.

Only the latest release receives security updates.

We follow coordinated disclosure. Public disclosure happens after a fix is released.