swaits
57a43c260e
Companion to the feat(async) commit. Brings every cross-referencing doc up to v0.8 currency, replaces marketing-flavored copy with plain prose, and replaces toy benchmark problems with relatable ones that include actual run output and interpretive narrative. - README: collapses the four-bullet "Read the user guide / API reference / Tested with N tests / Hot paths optimized" list into a single Docs links line. - README: replaces the Schaffer-N1 toy problem with a PickACar multi-objective design problem — three decision variables (displacement, weight, drag), four objectives (price, 0-60, fuel, noise), and *nonlinear* cost relationships so the Pareto front is a real surface, not a 1D sweep. Includes actual NSGA-III run output (representative slice across the 100-car front) and a narrative explaining what each row tells you and why hand- picking would miss the interesting tradeoffs. - README: removes rustdoc-style hidden `#` setup lines from code blocks. The README is rendered as plain markdown on GitHub / crates.io, where those lines are visible garbage instead of hidden setup. Code blocks are now self-contained. - Guide quickstart (getting-started.md): replaces Sphere ( Σ x² ) with a least-squares LineFit example. Same shape (single- objective continuous), but recognizable framing. Includes actual CMA-ES output, residual table, and narrative comparing the answer to standard regression. - Algorithm count audit: stale "35 algorithms" claim corrected to the actual 33 across README, src/lib.rs, introduction.md, and the comparison.md table cell. - Async feature flag listed in the optional-features sections of README, src/lib.rs, getting-started.md. - introduction.md, choosing-an-algorithm.md, comparison.md, stability.md, migration.md, cookbook/parallel.md, cookbook/custom-optimizer.md: cross-references updated to describe full async coverage and link the new cookbook recipe. - stability.md: removes the speculative "Observer / Snapshot / Checkpoint planned" bullet (those didn't ship); documents the AsyncProblem / AsyncPartialProblem trait stability. - migration.md: new "To 0.8" section with paths from 0.5.x and 0.7.x. - CHANGELOG: 0.8.0 entry capturing the async feature plus the documentation / governance / CI catch-up. - SECURITY.md: supported versions table reflects 0.8.x.
63 lines
2.2 KiB
Markdown
63 lines
2.2 KiB
Markdown
# Security policy
|
|
|
|
## Supported versions
|
|
|
|
Security fixes are applied to the latest released minor version on
|
|
crates.io. Patch-level releases (`0.x.y` → `0.x.y+1`) are issued as
|
|
needed.
|
|
|
|
| Version | Supported |
|
|
|---------|--------------------|
|
|
| 0.8.x | ✅ |
|
|
| ≤ 0.7.x | ❌ (please upgrade) |
|
|
|
|
heuropt is pre-1.0; the public API may change between minor versions.
|
|
Once 1.0.0 ships, the support window will be at least the latest two
|
|
minor versions.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please **do not** open a public GitHub issue for a security bug.
|
|
Instead use one of these channels:
|
|
|
|
- GitHub's [private vulnerability reporting](https://github.com/swaits/heuropt/security/advisories/new)
|
|
on the repository.
|
|
- Email **steve@waits.net** with subject line `[heuropt security]
|
|
<short summary>`.
|
|
|
|
Please include:
|
|
|
|
1. A description of the vulnerability and the affected versions.
|
|
2. The smallest reproducer you can produce — a `cargo run --example
|
|
repro` is ideal.
|
|
3. Your assessment of impact and exploitability.
|
|
4. Any suggested mitigation if you have one.
|
|
|
|
## What I will do
|
|
|
|
- Acknowledge the report within **72 hours**.
|
|
- Confirm or refute reproducibility within **7 days**.
|
|
- Issue a fix in a patch release within **30 days** for confirmed
|
|
high-severity issues; less urgent issues may roll into the next
|
|
minor release.
|
|
- Credit the reporter in the CHANGELOG entry unless you ask
|
|
otherwise.
|
|
|
|
## What counts as a security issue
|
|
|
|
heuropt is a numerical library, not a network service or sandbox. The
|
|
realistic security-relevant categories are:
|
|
|
|
- **Memory safety**: any unsafe-code-related UB or unwinds-across-FFI
|
|
bug. heuropt itself uses no `unsafe`; this category covers
|
|
dependencies it transitively pulls in.
|
|
- **Denial of service**: an input to a public API that causes
|
|
unbounded memory growth, infinite loop, or panic outside its
|
|
documented panic conditions. (Documented panics for invalid config
|
|
are not bugs.)
|
|
- **Supply-chain compromise**: a published heuropt crate that doesn't
|
|
match the source on the tagged commit.
|
|
|
|
Functional correctness bugs (an algorithm produces wrong
|
|
hypervolumes, etc.) are tracked as ordinary issues, not security.
|