Security updates are provided for the latest stable Doria toolchain release. Canary and release-candidate builds are pre-release channels and may be replaced by a newer pre-release rather than patched in place.

Please do not open a public issue for a suspected vulnerability.

Use GitHub's private vulnerability reporting and include:

• the affected Baton or Doria toolchain version;
• the operating system and architecture;
• a minimal reproduction or proof of concept;
• the security impact;
• any known workarounds;
• whether the issue has been disclosed elsewhere.

Do not include credentials, private keys, access tokens, or unrelated personal data. The maintainers will acknowledge the report through the private advisory, investigate it, and coordinate disclosure and release information there.

Baton is designed around these boundaries:

• compiler processes are invoked with argument vectors, never shell-interpolated commands;
• the compiler bundled with the selected toolchain takes precedence over PATH;
• development overrides require explicit opt-in;
• component paths must remain inside the toolchain root;
• installed component identities and SHA-256 hashes are verified;
• project entry paths must remain inside the project root;
• autoload roots and every discovered source must remain inside the project root after symlink resolution;
• source paths must use exact filesystem case and remain collision-free under portable ASCII case folding;
• managed build paths are checked component by component before writes, so an intermediate symlink cannot redirect plans, receipts, or artifacts;
• project manifests are data and do not execute code;
• PHP-bootstrap prereleases use an isolated private PHP runtime without user configuration or system extensions; production distributions remove that runtime at the mandatory Doria-native cutover;
• Baton does not execute PHP supplied by a Doria project;
• workspace members, generated files, dispatcher files, and processor output remain contained after canonicalization and symlink resolution;
• external processes are launched with argument vectors, bounded output, and bounded execution time rather than shell interpolation;
• runtime test outcome files are treated as untrusted bounded binary input: Baton uses nonce-bearing managed paths, rejects malformed or oversized DORIAO2/DORIAO3/DORIAO4 records and trailing bytes, and removes each outcome after classification;
• diagnostic commands must not expose secrets.

Changes that weaken one of these boundaries require explicit security review and regression coverage.

The package resolver preserves the same inert-data boundary. Dependency sources are explicit and exactly locked; remote lock entries keep canonical source URLs but never credentials, tokens, or secret query parameters. Conflicting sources for one package identity are diagnosed. Arbitrary archive URLs and implicit build scripts are rejected. Processors are explicit, source-locked, visible in build output, and write only beneath their managed generated-source root. Publication is atomic and cannot replace handwritten or another processor's source.

A processor is an executable program and may run arbitrary code with the user's account authority. Baton provides no processor sandbox, filesystem isolation, network isolation, or permission prompt. Review processor source and lock facts with the same care as any native build tool.

Offline mode never reaches the network or substitutes another version. The global dependency cache is content-addressed by exact source identity and integrity facts. Git runs non-interactively with isolated configuration, disabled hooks and filters, no submodules, sanitized failures, immutable exact checkouts, and symlink-contained cache writes. Baton resolves manifests and source inventories but never executes ordinary dependency source. Offline mode never builds or launches processors and accepts only an exact complete cached result.