Security fixes are applied to the latest release only. Older releases are not patched.

Please report security vulnerabilities privately through GitHub's private vulnerability reporting rather than opening a public issue.

mach-json reads untrusted input by design: JSON documents from any producer. A malformed input that makes json crash, hang, or read or write out of bounds is a vulnerability and is welcome as a report.

Expect an acknowledgement within a few days. If the report is confirmed we will prepare a fix and coordinate disclosure with you. If it is declined we will explain why.