swaits
38dfeafe56
CI / rustfmt (push) Waiting to run
CI / clippy --all-features (push) Waiting to run
CI / test (default) (push) Waiting to run
CI / test (parallel) (push) Waiting to run
CI / test (serde) (push) Waiting to run
CI / test (serde,parallel) (push) Waiting to run
CI / cargo doc (push) Waiting to run
CI / minimum supported Rust version (1.85) (push) Waiting to run
CI / fuzz smoke (clamp_to_bounds) (push) Waiting to run
CI / fuzz smoke (crowding_distance) (push) Waiting to run
CI / fuzz smoke (hypervolume_2d) (push) Waiting to run
CI / fuzz smoke (non_dominated_sort) (push) Waiting to run
CI / fuzz smoke (pareto_archive) (push) Waiting to run
CI / fuzz smoke (pareto_compare) (push) Waiting to run
CI / fuzz smoke (sbx_polymut) (push) Waiting to run
CI / fuzz smoke (spacing) (push) Waiting to run
Docs / Build mdbook (push) Waiting to run
Docs / Deploy to GitHub Pages (push) Blocked by required conditions
Rewrites lingering github.com / *.sr.ht references to this Gitea instance, translating GitHub and Sourcehut URL shapes to Gitea's (/blob/<ref>/ and sr.ht /tree/<ref>/item/ -> /src/branch/<ref>/, /tree/<tag> -> /src/tag/<tag>, /actions/workflows/X -> /actions?workflow=X, /edit/ -> /_edit/). Left pointing at the old hosts on purpose: pull-request links (PRs were not migrated), forks that were never migrated, and GitHub-only surfaces Gitea lacks. OpenPGP identity proofs are untouched by design.
64 lines
2.2 KiB
Markdown
64 lines
2.2 KiB
Markdown
# Security policy
|
|
|
|
## Supported versions
|
|
|
|
Security fixes are applied to the latest released minor version on
|
|
crates.io. Patch-level releases (`0.x.y` → `0.x.y+1`) are issued as
|
|
needed.
|
|
|
|
| Version | Supported |
|
|
|---------|--------------------|
|
|
| 0.10.x | ✅ |
|
|
| ≤ 0.9.x | ❌ (please upgrade) |
|
|
|
|
heuropt is pre-1.0; the public API may change between minor versions.
|
|
Once 1.0.0 ships, the support window will be at least the latest two
|
|
minor versions.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please **do not** open a public issue for a security bug.
|
|
Instead:
|
|
|
|
- Email **steve@waits.net** with subject line `[heuropt security]
|
|
<short summary>`.
|
|
|
|
(This project is hosted on [git.swaits.com](https://git.swaits.com/swaits/heuropt),
|
|
which has no private-advisory feature, so email is the reporting channel.)
|
|
|
|
Please include:
|
|
|
|
1. A description of the vulnerability and the affected versions.
|
|
2. The smallest reproducer you can produce — a `cargo run --example
|
|
repro` is ideal.
|
|
3. Your assessment of impact and exploitability.
|
|
4. Any suggested mitigation if you have one.
|
|
|
|
## What I will do
|
|
|
|
- Acknowledge the report within **72 hours**.
|
|
- Confirm or refute reproducibility within **7 days**.
|
|
- Issue a fix in a patch release within **30 days** for confirmed
|
|
high-severity issues; less urgent issues may roll into the next
|
|
minor release.
|
|
- Credit the reporter in the CHANGELOG entry unless you ask
|
|
otherwise.
|
|
|
|
## What counts as a security issue
|
|
|
|
heuropt is a numerical library, not a network service or sandbox. The
|
|
realistic security-relevant categories are:
|
|
|
|
- **Memory safety**: any unsafe-code-related UB or unwinds-across-FFI
|
|
bug. heuropt itself uses no `unsafe`; this category covers
|
|
dependencies it transitively pulls in.
|
|
- **Denial of service**: an input to a public API that causes
|
|
unbounded memory growth, infinite loop, or panic outside its
|
|
documented panic conditions. (Documented panics for invalid config
|
|
are not bugs.)
|
|
- **Supply-chain compromise**: a published heuropt crate that doesn't
|
|
match the source on the tagged commit.
|
|
|
|
Functional correctness bugs (an algorithm produces wrong
|
|
hypervolumes, etc.) are tracked as ordinary issues, not security.
|