Yuku

Security

Yuku processes source code that may be attacker controlled, so it treats every input as untrusted.

Reporting a vulnerability

Please do not open a public issue. Report privately through GitHub’s private vulnerability reporting, or email arshadpyaseen@gmail.com.

We aim to acknowledge reports within 72 hours. Please allow a reasonable window for a fix before public disclosure. We are glad to credit you in the advisory. Fixes ship against the latest version.

Our practices

No third-party dependencies. The npm package has none and runs no install scripts, and the Zig build has none.
Provenance publishing. Releases publish to npm with provenance through OIDC trusted publishing, with no long-lived tokens.
Hardened CI. Every action is pinned to a commit hash, workflow tokens are read-only by default, and zizmor and OpenSSF Scorecard check the workflows.
Reproducible builds. Installs use a frozen lockfile.
Memory safety. A parse allocates everything in one arena and frees it in one step. Where the npm package runs Yuku as WebAssembly, it is also sandboxed from host memory.
Fuzzing. Millions of adversarial inputs per run, see Testing.