The Fountain-Coach/midi2 maintainers take security vulnerabilities seriously. We appreciate your efforts to responsibly disclose your findings.

Please do not report security vulnerabilities through public GitHub issues.

Instead, use one of the following methods:

1. Navigate to https://github.com/Fountain-Coach/midi2/security/advisories
2. Click "Report a vulnerability"
3. Fill in the vulnerability details
4. Submit the report

This creates a private security advisory that only the maintainers can see.

If you prefer email or cannot use GitHub's private reporting:

• Email: mail@benedikt-eickhoff.de
• Subject line: [SECURITY] midi2 vulnerability: [brief description]

Include in your report:

• Description of the vulnerability
• Steps to reproduce the issue
• Affected versions (if known)
• Potential impact and attack scenarios
• Any suggested fixes or mitigations

If you prefer encrypted communication, request the current PGP public key via the security contact email and we will share the fingerprint and key location.

We aim to respond to security reports according to the following timeline:

• Acknowledgment: Within 24 hours of report submission
• Initial assessment: Within 72 hours (severity classification)
• Status update: Weekly updates until resolved
• Fix timeline:
  • Critical (CVSS 9.0-10.0): 24 hours
  • High (CVSS 7.0-8.9): 72 hours
  • Medium (CVSS 4.0-6.9): 2 weeks
  • Low (CVSS 0.1-3.9): 1 month

We follow coordinated disclosure principles:

1. Private fix development: We develop fixes in private before public disclosure
2. Coordination: We coordinate with you (the reporter) on disclosure timing
3. Default timeline: 90 days from initial report to public disclosure
4. Early disclosure: Critical vulnerabilities may be disclosed earlier if actively exploited
5. Credit: We will credit you in the security advisory (unless you prefer anonymity)

1. Acknowledgment: We confirm receipt and start investigation
2. Validation: We reproduce and assess the vulnerability
3. Fix development: We develop and test a fix in a private repository/branch
4. Pre-release notification: We notify you before publishing the fix
5. Public disclosure: We publish a security advisory and release patched versions
6. CVE assignment: We request a CVE identifier for qualifying vulnerabilities

We provide security updates for the following versions:

Policy:

• Current MINOR version: Full support (patches, security updates)
• Previous MINOR version: Critical security fixes for 90 days after new release
• Older versions: No security updates; users must upgrade

When using the midi2 library:

• Keep dependencies updated: Regularly update to the latest stable version
• Validate MIDI input: Always validate and sanitize untrusted MIDI data before processing
• Limit resource usage: Implement timeouts and rate limiting for MIDI processing
• Avoid unsafe APIs: Do not use deprecated or unsafe functions

• Use latest version: Install via npm install @fountain-coach/midi2@latest
• Audit dependencies: Run npm audit regularly to check for vulnerabilities
• Validate input: Sanitize MIDI data from untrusted sources (WebMIDI, file uploads)
• Content Security Policy: Configure CSP headers when using midi2.js in web applications
• Avoid eval/injection: Do not pass untrusted data to dynamic code execution

• Enable Dependabot: Use .github/dependabot.yml to auto-update dependencies
• Run security scans: Use CodeQL, npm audit, or Swift package audits in CI
• Pin versions: Use exact versions in production deployments
• Monitor advisories: Subscribe to GitHub security advisories for this repository

• Malformed packets: The library includes validation for UMP format, but always handle parse errors gracefully
• Resource exhaustion: Large SysEx messages or rapid message rates may cause memory/CPU spikes; implement rate limiting
• Integer overflow: MIDI timestamps use 64-bit integers; ensure your system handles large values

The midi2 project depends on:

• Swift: swift-argument-parser, swift-numerics, SwiftCheck (dev)
• JavaScript: vitest (dev), tsup (dev), typescript (dev)

We monitor these dependencies for security advisories via Dependabot.

• iOS/macOS: CoreMIDI bridging code runs with system MIDI permissions; validate all inputs
• Linux: ALSA bindings require native library access; ensure ALSA is up-to-date
• Web browsers: WebMIDI requires user permission; never bypass browser security policies

Past security advisories will be listed here:

No security advisories published yet.

To receive notifications about security updates:

1. GitHub Watch: Click "Watch" → "Custom" → ☑ "Security alerts" on the repository page
2. GitHub Advisory Database: Subscribe to https://github.com/advisories?query=ecosystem%3Anpm+@fountain-coach/midi2
3. npm: Security advisories are published via npm registry metadata
4. Dependabot: Automatically creates PRs for vulnerable dependencies

For non-security issues, please use:

• Bug reports: https://github.com/Fountain-Coach/midi2/issues
• Questions: https://github.com/Fountain-Coach/midi2/discussions

For security-related inquiries only:

• Email: mail@benedikt-eickhoff.de
• GitHub Security Advisories: https://github.com/Fountain-Coach/midi2/security/advisories

This security policy is based on best practices from:

• GitHub Security Advisories
• OWASP Vulnerability Disclosure Cheat Sheet
• Carnegie Mellon CERT Coordinated Disclosure

Last updated: 2025-12-14