If you find a significant vulnerability, or evidence of one, please report it privately.

We prefer the GitHub mechanism for privately reporting a vulnerability: under the repository’s security tab, click “Report a vulnerability” to open the advisory form.

For how we secure the release process itself — build provenance, SBOMs, signed attestations — see SUPPLY_CHAIN_SECURITY.md. Our container has no OS at all, so there’s no OS trust store to verify outbound TLS connections against either — see that document’s “Certificate trust” section for what we do instead.

Every change also goes through SAST via GitHub CodeQL, enforced by branch protection on main — see TESTING.md for details. We publish an OSSF Scorecard analysis on every push to main (badge in the README); its “Vulnerabilities” check reports known, already-public advisories in our dependencies (RUSTSEC/OSV) — the same ones Dependabot already opens PRs for. A nonzero score there isn’t a new finding and doesn’t need private disclosure; check open pull requests for the fix already in progress.

On top of that, cargo-deny.yml gates PRs and runs weekly, via cargo-deny against the rules in deny.toml — dependency licenses, banned/duplicated crates, untrusted sources, and known advisories alike. An advisory that’s already known, already tracked, and not fixable from this repo (e.g. pinned deep in a dependency we don’t control) can be allow-listed there with a reason and a link to the upstream fix, rather than leaving CI red on something no PR here can resolve.