# Security Policy
## Supported Versions
Use the latest released crate version or the default branch. Security fixes
are not backported to older versions unless noted in a release.
This crate is pre-1.0 and under active development, so API compatibility and
security support are tied to the current release line.
## Reporting a Vulnerability
Please report vulnerabilities privately using GitHub private vulnerability
reporting:
<https://github.com/acgetchell/la-stack/security/advisories/new>
Do not open a public issue for suspected vulnerabilities.
Include:
- Affected crate version or commit.
- Enabled Cargo features, especially `exact` if exact arithmetic is involved.
- Steps to reproduce, ideally with a minimal Rust example or test.
- Expected and observed behavior.
- Security impact, such as a panic, denial of service, or incorrect result.
- Any relevant matrix, vector, or benchmark input shape, with sensitive data
removed.
- A suggested fix or mitigation, if available.
For numerical correctness issues that are not security-sensitive, open a
normal GitHub issue with a minimal reproduction.
## Disclosure Process
- Reports are acknowledged as maintainer availability allows.
- The issue is triaged and its severity assessed on a best-effort basis.
- Accepted reports receive updates when there is meaningful progress or a
material change in the assessment.
- For an accepted vulnerability, the project prepares a fix, publishes a
GitHub Security Advisory, releases the fix, and requests a RustSec advisory
when appropriate.
- If a report is declined, the reporter receives an explanation.
Please follow coordinated disclosure and avoid public disclosure until a fix
or mitigation is available.
## Scope
The crate uses `#![forbid(unsafe_code)]`, which reduces memory-safety risk.
Security-relevant correctness and availability issues can still exist. In
scope are:
- Panics or crashes triggered by malformed or adversarial matrices or vectors.
- CPU or memory denial of service caused by crafted inputs, including inputs
to optional exact-arithmetic paths.
- Incorrect numerical results that affect security, data integrity, or
availability when processing untrusted input.
- Violations of documented exact-arithmetic guarantees, such as silent
precision loss, when they have a security impact.
Out of scope are:
- Documented floating-point limitations, conditioning behavior, or rounding
bounds that do not create a security impact.
- Performance limitations that are not exploitable as denial of service.
- Issues caused by use outside the documented API contracts or supported
problem scope.
## Patch and Advisory Policy
- Fixes are released on the latest supported release line. Older releases
receive fixes only when explicitly noted.
- Releases are published to crates.io with corresponding GitHub releases.
- Accepted vulnerabilities are documented with GitHub Security Advisories and,
when appropriate, RustSec advisories.
- Public technical detail may be limited until users have had a reasonable
opportunity to update.
## RustSec
Applicable vulnerabilities may be disclosed through the
[RustSec Advisory Database](https://github.com/RustSec/advisory-db), enabling
detection with `cargo audit`.
## Safe Harbor
Good-faith security research is welcome. Avoid privacy violations, data
destruction, persistence, service disruption, and public disclosure before a
fix or mitigation is available. Reports that follow coordinated disclosure
and make a reasonable effort to avoid harm are treated as helpful
contributions.
## Acknowledgements
Responsible disclosure is appreciated. Reporters may be credited in
advisories or release notes unless anonymity is requested.
## Security Checks
This project uses GitHub CodeQL, Dependabot security updates, secret scanning
with push protection, `cargo audit`, zizmor, Clippy SARIF analysis, and
repository-owned Semgrep rules.
`just security` adds shared OSV dependency auditing and Gitleaks scans of reachable
Git history and current tracked/nonignored files. Both use declared managed
binaries installed by shared setup and retain redacted JSON/SARIF reports under
`target/security`. See the [contributor workflow](CONTRIBUTING.md#getting-started)
for the separate scan commands and prerequisites.
### Historical identifier false positive
Gitleaks flags a historical compatibility alias in `scripts/bench_compare.py`
at commit `d8f9897f59cce0a220efdbbcbaaf9180861889e9`. The alias assigns one Python
identifier to another; the assignment contains no credential.
`.gitleaks.toml` retains the default detectors and permits only this exact
assignment in that file. Other assignments and paths remain checked.
### Python tool dependencies
Semgrep 1.180.0 accepts `pyjwt[crypto]>=2.15.0,<3`, so the older security override
is retired. `tooling/semgrep/uv.lock` retains patched PyJWT 2.15.1 and its crypto
dependencies. Validate native Semgrep scans when changing the scanner or lock.
Semgrep 1.180.0 pins MCP 1.29.0, which is affected by
[GHSA-84m7-p3x7-pcfv](https://github.com/advisories/GHSA-84m7-p3x7-pcfv).
The isolated environment overrides that pin with `mcp>=1.30.0,<2`, retaining
the patched 1.x API. Remove the override when a released Semgrep dependency
accepts a patched MCP version. The root support environment has no MCP dependency.
`just audit` includes both Python lockfiles, and Dependabot is configured for both
environments. Its [root graph job](https://github.com/acgetchell/la-stack/actions/runs/38871146224)
currently rejects Python 3.15, so the root dependency alerts can be stale; use
`just audit` to check the current inventory until upstream supports Python 3.15.
The isolated scanner remains on Python 3.14 while its wheels exclude Python 3.15;
support scripts run on Python 3.15.
### Numerical logging false positives
CodeQL's `rust/cleartext-logging` query uses name-based heuristics to identify
potentially sensitive data. Here, `Matrix::certified_error_bound` and the
benchmark helper's `certified_bound` refer to numerical rounding-error bounds.
They contain no credentials, cryptographic certificates, or personal information.
Alerts #171–#178 were reviewed against commit
`bd80cc05df3ebf409d8db9a471b671a5737bf0c4`: their sinks are assertion or panic
diagnostics for deterministic test and benchmark fixtures. These individual
alerts were dismissed as false positives with that rationale. Keep the query
enabled and preserve diagnostic values needed to investigate numerical failures.
Review new alerts on their own data flow.
### Benchmark dependency maintenance
As of October 16, 2026, `paste` 1.0.15 enters through the development dependency
`faer` 0.24.4, via `gemm` 0.19.0 and `pulp` 0.22.3. Those are the latest
published upstream versions checked on that date. Repository-owned Rust code
already uses `pastey`; changing that direct dependency cannot replace upstream
uses of `paste`.
[RUSTSEC-2024-0436](https://rustsec.org/advisories/RUSTSEC-2024-0436.html) is an
unmaintained-package advisory with no patched version. It is a genuine
maintenance concern, separate from the logging false positives. `paste` is absent
from the library's normal and build dependency graph, including with `exact`
enabled, but its procedural macro executes when building development targets.
The root `osv-scanner.toml` temporarily accepts only `RUSTSEC-2024-0436` until
January 1, 2027, when OSV resumes blocking on it. This is a documented acceptance
of the maintenance risk, not a patched dependency. Native OSV configuration
discovery applies it to the root lockfiles scanned by `just security`; `paste`
remains in the package inventory, and all other advisories remain enabled.
Keep this advisory visible in `cargo audit`. Recheck the dependency path with
`cargo tree --locked --workspace --all-features -i paste` when updating `faer`,
`gemm`, or `pulp`. Remove both the dependency and its OSV exception through a
maintained upstream release when available; reassess explicitly before extending
the exception.