# Security policy
## Supported versions
While the crate is pre-1.0, only the latest published minor version receives
security fixes.
| 0.1.x | yes |
## Reporting a vulnerability
Please report privately, via
[GitHub's private vulnerability reporting](https://github.com/ScioFuturum/fastx/security/advisories/new),
rather than opening a public issue.
Include the input that triggers the problem (or a generator for it), the version
of `fastx`, and the feature flags you built with. A reproducer under
`cargo fuzz run <target>` or as a failing test is ideal but not required.
We aim to acknowledge within a week and to ship a fix or a mitigation plan within
30 days, coordinating disclosure with you and publishing a RUSTSEC advisory.
## Threat model
`fastx` parses files. Assume the files are hostile: they may come from a public
submission portal, a collaborator's flash drive, or a partly overwritten disk.
Within that scope, these count as vulnerabilities:
- **Any panic, abort or unwind** reachable from parsing input. The parser is
fuzzed for exactly this, and there is no `unsafe` code anywhere in the crate
(`#![forbid(unsafe_code)]`), so memory-safety bugs would have to come from a
dependency.
- **Unbounded memory growth** on input that is small on disk. Note that limits
are opt-in: if you feed untrusted data, set
[`ReaderBuilder::max_line_length`] and [`ReaderBuilder::max_record_length`].
A report that a *limitless* reader consumed memory proportional to its input
is expected behaviour, not a vulnerability.
- **Silently wrong data**: a record that parses to different bases or quality
scores than the file contains, or an index that resolves a region to the wrong
offset. Corrupt scientific results are as serious as a crash.
- **Path traversal or unexpected writes** from a sequence name, for example via
`fastx faidx` writing outside the directory it was pointed at.
Out of scope: resource use proportional to input when no limits are configured;
denial of service from decompressing a legitimately huge gzip stream (set your
own byte budget on the reader); and anything requiring the attacker to already
control your process.
[`ReaderBuilder::max_line_length`]: https://docs.rs/fastx/latest/fastx/reader/struct.ReaderBuilder.html#method.max_line_length
[`ReaderBuilder::max_record_length`]: https://docs.rs/fastx/latest/fastx/reader/struct.ReaderBuilder.html#method.max_record_length