Report privately through GitHub Security Advisories. Please do not open a public issue for a suspected vulnerability.

Useful in a report: the protocol revision and transport, a request that triggers it, what you expected and what happened. A failing test is welcome and never required.

This package is maintained by one person, and the commitment is written to be one that can be kept rather than one that sounds reassuring:

• Acknowledgement within 7 days. If you have heard nothing after 7 days, assume the report did not arrive and open a public issue saying only that you are waiting on a security response — no detail.
• An assessment within 30 days of acknowledgement: whether it is in scope, and if so a rough severity and intended fix window. If it will take longer, you will be told that instead of being left waiting.
• Credit in the advisory and the changelog, unless you ask otherwise.

There is no paid bounty, and no guaranteed fix deadline. A single maintainer cannot honestly promise a 24-hour turnaround, so this policy does not.

The package's own code, lib/:

• Protocol handling — malformed, hostile or ambiguous JSON-RPC that crashes the server, bypasses validation, or is answered under the wrong protocol revision.
• Framing and bounds — input that escapes the line or body limits, or desynchronises the reader so one message is interpreted as another.
• Schema validation — arguments that reach dispatch despite violating the schema the catalog advertised, including key- or type-confusion between the validated form and the dispatched form.
• Era confusion — a request served under a protocol revision other than the one it declared.
• Information disclosure across the wire boundary — server internals reaching a client that should not see them.

• What a host's tools do. This package validates and routes; it does not execute. A tool that deletes files when asked is the host's design, not a defect here.
• Anything the host injects — the catalog, the dispatch function, and whatever they reach.
• Transport security. stdio is a local pipe; confidentiality and authentication of that channel belong to whatever spawns the process.
• Denial of service through legitimate volume. Bounds exist to stop unbounded buffering, not to ration throughput.
• Dependencies, unless the defect is in how this package uses one. Report those upstream.

Recorded so they are not reported as discoveries, and so their status is not mistaken for ignorance of them:

• Error payloads carry inspect/1 output, so Elixir term syntax reaches the wire. It is a boundary defect, it is tracked, and it is fixed before the first release.
• The package is pre-1.0 and unpublished. No version has shipped, so there is no supported release to backport a fix to yet.

None yet — nothing is published. When a release exists, this section will name which versions receive fixes.