hashavatar 1.0.0

Stable deterministic procedural avatars in Rust with configurable identity hashing, WebP, optional PNG/JPEG/GIF, and SVG export
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

# Security Policy

## Supported Versions

Security fixes are expected for the latest published release series.

## Reporting a Vulnerability

Please report security issues privately through GitHub Security Advisories for:

`https://github.com/valkyoth/hashavatar/security/advisories/new`

If GitHub advisories are unavailable, open a minimal public issue that asks for a private contact path without disclosing exploit details.

## Scope

Relevant security issues include:

- panics or resource exhaustion from untrusted avatar parameters
- unsafe SVG or output encoding behavior
- vulnerable dependency paths
- license or provenance concerns that affect safe redistribution

Please include reproduction steps, affected versions, and any known mitigations.

## Local Security Checks

Run the crate security and release policy checks with:

```bash
scripts/checks.sh
```

The checks cover release metadata, package contents, dependency scope, unsafe-code policy, reviewed panic-like sites, fuzz harness compilation, dependency licenses, and RustSec advisories.