Grotto is a security-critical runtime: it is the trusted computing base for
every program it executes. By design, safety lives in the language itself, not
in an external enforcement layer — a program that passes validation is safe to
execute by construction. Neander programs have no file, network, code-generation, or
dynamic-evaluation capability; their only effects are through registered call
dispatches, and every submission runs in its own isolated worker. We take
security reports seriously.
Grotto is pre-1.0 (0.x) and tracks a draft language spec; interfaces and
behavior may change without notice, and it is provided as is, without
warranty (see LICENSE). Evaluate and review it yourself before
relying on it in production. Only the latest released version on the default
branch receives security fixes.
| Version | Supported |
|---|---|
0.1.x |
✅ |
< 0.1 |
❌ |
Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Instead, report privately using GitHub's private vulnerability reporting: open the Security tab of this repository and click Report a vulnerability.
Please include, as far as you can:
- A description of the issue and its impact.
- Steps to reproduce (a minimal Neander program or request is ideal).
- The affected version / commit and your runtime configuration.
- We aim to acknowledge a report within 5 business days.
- We will work with you to confirm the issue and determine its severity.
- We will keep you informed of remediation progress and coordinate disclosure timing with you. Please give us a reasonable window to release a fix before any public disclosure.
The HTTP adapter ships without authentication by design — it is intended to run behind a gateway that provides auth, rate limiting, and quotas, and binds to loopback by default. Reports that depend solely on exposing the adapter directly to untrusted networks without such a gateway are out of scope.
In scope is anything that breaks the runtime's by-construction safety guarantees, for example:
- a program that passes validation but performs unintended effects or I/O, or otherwise subverts the interpreter;
- bypassing resource budgets (Thalers, memory, duration, per-call timeout) to wedge or exhaust the host;
- one submission observing or influencing another (a break in cross-submission isolation);
- subversion of the runtime via a crafted manifest or a faulty API handler;
- incorrect or unsafe response envelopes (e.g., leaking host internals).