The GitHub Releases page is authoritative for the latest published minor. The main branch can identify itself as the next version while that version is still undergoing release qualification.

We support the latest minor release with security patches. Once a new minor or major version is published, prior versions receive patches only for critical vulnerabilities at maintainer discretion.

Please do not open public GitHub issues for security vulnerabilities.

Instead, use GitHub Private Vulnerability Reporting:

1. Go to the Security Advisories tab
2. Click "Report a vulnerability"
3. Fill in the details — affected crate(s), reproduction steps, and impact assessment

No alternate private contact channel is published in this repository. If the GitHub reporting control is unavailable, contact a maintainer without including exploit details and ask for a private disclosure channel.

• Acknowledgment within 48 hours
• Initial assessment within 5 business days
• Patch timeline depends on severity:
  • Critical / High: Target fix within 7 days
  • Medium: Target fix within 30 days
  • Low: Next scheduled release
• We will coordinate disclosure timing with you. We follow responsible disclosure practices.

• Vulnerabilities in gvm-protocol, gvm-gmp, gvm-client, or gvm-connection
• Authentication bypass or credential exposure in transport handling (SSH, Unix socket, TLS)
• XML parsing vulnerabilities (injection, XXE, billion-laughs)
• Memory safety issues
• Dependency vulnerabilities with a viable attack path through our code

• Vulnerabilities in gvm-mock-server — it is a testing tool, not production software
• Issues in upstream dependencies without a demonstrated attack path through rust-gvm
• Denial-of-service via malformed GMP XML from a trusted gvmd server (trusted network assumption)

• cargo-audit runs on relevant pushes and pull requests plus the weekly Security workflow, checking against the RustSec Advisory Database
• cargo-deny enforces license compliance, bans, and source restrictions (see deny.toml)
• Dependabot monitors Cargo, pip, Docker, and GitHub Actions dependencies with weekly update PRs (.github/dependabot.yml)
• cargo-machete checks for unused dependencies in CI
• cargo-vet, workspace unsafe-code gates, Semgrep, and release-SBOM quality checks are also part of the Security aggregate

There are currently no accepted RustSec advisory exceptions. The SSH dependency is built without russh's optional RSA support, removing the vulnerable rsa crate from the resolved graph while retaining compression and AWS-LC.

• All dependencies sourced exclusively from crates.io
• Git dependencies denied by default ([sources] unknown-git = "deny")
• GitHub Actions pinned to immutable commit SHAs; Dependabot keeps them current
• CycloneDX JSON is generated and quality-gated in Security; tagged releases publish the verified JSON/XML SBOM bundle

• cargo clippy with -D warnings in CI
• workspace unsafe_code = "forbid", reinforced by the Security workflow's source and cargo-geiger gates
• MSRV tested (currently Rust 1.89.0)
• XML framing uses quick-xml with a 64 MiB default frame limit and a separate 256-element nesting limit; transport response and mock request limits are configurable

┌─────────────┐     GMP/XML      ┌──────────┐
│ rust-gvm    │◄────────────────►│  gvmd    │
│ (client)    │  Unix / SSH / TLS │ (server) │
└─────────────┘                   └──────────┘
       ▲
       │ The transport layer (gvm-connection) handles:
       │ • SSH host key verification
       │ • Unix socket file permissions (OS-level)
       │ • TLS certificate and DNS/IP SAN validation
       │
       │ GMP authentication is username/password over
       │ the encrypted transport — never plaintext TCP.

• gvmd is trusted: rust-gvm is a client library; it trusts the server's XML responses. Malicious server responses are out of scope (same trust model as python-gvm).
• Credentials: Passed at runtime, never stored by the library. Callers are responsible for secure credential management.
• Transport security: SSH and TLS transports encrypt all GMP traffic. Unix sockets rely on filesystem permissions.

GitHub repository settings below were verified live on 2026-09-21. They are distinct from workflow configuration kept in this checkout.

Recheck these live settings after repository-visibility, branch-protection, or security-policy changes. Required signed commits remain a separate policy decision; they are not enabled as of the verification date.