Report privately, through GitHub's private vulnerability reporting on this repository's Security tab. If that road is closed to you, open an ordinary issue that says only that you have something to report and asks for a private channel — no detail, no reproduction.
You will get an acknowledgement. There is no response-time promise until there is a release to stand behind, because a number nobody can hold to is worse than none.
The most recent published 0.1 release, when one exists, is supported.
Before the first publication, a report names the revision it is against.
| Road | What it looks like |
|---|---|
| Dependencies | The resolved graph differs from what the manifests and deny.toml declare |
| Ambient input | Expansion or judgment influenced by anything but declared input — network, filesystem, environment, clock, entropy |
| Exhaustion | A request or a descriptor an attacker controls that exhausts CPU, memory, stack, or I/O |
| Escaped output | A generated unit reaching a destination its plan did not name, or a member the closure never proved |
| False evidence | A harness verdict that misattributes, drops, or fabricates what it observed |
- Anything that needs
unsafe. The lint wall forbids it, so the report is about a different repository. - A scanner identifier on its own. A report names the road: what the attacker controls, what they reach, what they get.
- The semantics, runtime, or deployment of a library that uses Macroonz. Those are reports to that library.
The exact revision, toolchain, and command, and the smallest input that shows the behaviour.