Security.

Report a vulnerability

Write to developer@venutian.org with what you found, the smallest way to reproduce it, and the version and platform you tested. We read every report and reply directly. Do not open a public issue, a forum post, or a social media report before we have had a chance to respond, so a fix can ship before the detail is public.

Our security.txt, at /.well-known/security.txt, carries the same contact in the machine readable format your tools already look for.

Scope

In scope: the Venutian compiler, virtual machine, native AOT backend, standard library, CLI, package manager, package registry API, and this website's backend, including the release feeds and the subscription flow.

Out of scope: a package published by another developer through the marketplace, once it opens, unless the vulnerability is in how Venutian itself loads or runs it; social engineering; and denial of service against infrastructure we do not operate.

Our response

We acknowledge every report, read it in full, and work with you to confirm it. Once confirmed, we fix it, ship the fix in the next release or, for a serious issue, an out of cycle one, and publish an advisory naming the affected versions and the fixed version. If you would like credit for the find, tell us and we will name you in the advisory. We ask for a reasonable window to ship a fix before any public disclosure, and we will tell you our target date once we have one.

Advisories

Every advisory below is written and published by us at the time we fix the issue, with its severity, the versions it affects, the version that fixes it, and the upgrade command for macOS, Linux, and Windows. There are no open advisories at this time.