Security

Reporting a vulnerability

Please do not open a public issue. Report privately through GitHub’s private vulnerability reporting, or email arshadpyaseen@gmail.com.

We aim to acknowledge reports within 72 hours. Please allow a reasonable window for a fix before public disclosure, and we are glad to credit you in the advisory. Fixes ship against the latest version of each package.

Our practices

• No third-party dependencies. The npm packages depend only on each other and run no install scripts.
• Provenance publishing. Releases publish to npm with provenance through OIDC trusted publishing, with no long-lived tokens.
• Hardened CI. Every action is pinned to a commit hash, workflow tokens are read-only by default, and the workflows are checked by zizmor and OpenSSF Scorecard.
• Reproducible builds. Installs use a frozen lockfile, and the one Zig dependency is pinned by content hash.
• Memory safety. A parse allocates everything in one arena, and the WebAssembly core runs sandboxed from host memory.
• Fuzzing. Millions of adversarial inputs per run, see Testing.