We actively support the following versions of SFX with security updates:

We take security seriously. If you discover a security vulnerability in SFX, please follow these steps:

Please do not open a public GitHub issue if the bug is a security vulnerability.

Send an email to: roriau@gmail.com

Include the following information:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact
• Suggested fix (if any)

• Initial Response: Within 48 hours of report
• Status Update: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: Within 7 days
  • High: Within 14 days
  • Medium: Within 30 days
  • Low: Next release cycle

• We follow responsible disclosure
• We will coordinate with you on the disclosure timeline
• Typically 90 days after the fix is released
• Credit will be given to reporters (unless you prefer anonymity)

DO report:

• Command injection vulnerabilities
• Path traversal issues
• Memory safety issues (despite Rust's safety)
• Arbitrary code execution
• Privilege escalation
• Information disclosure
• Denial of service (DoS) vulnerabilities

Examples in SFX context:

• Unsafe file operations in File module
• Command injection in System.Execute
• Resource exhaustion in JIT compiler
• Memory leaks in reactive observers
• Unsafe FFI in JIT compiled code

Please don't report:

• Issues with third-party dependencies (report to them directly)
• Social engineering attacks
• Physical security issues
• Theoretical vulnerabilities without proof of concept

When using SFX, follow these guidelines:

# Always validate user input
UserInput is File.Read("user_data.txt")

# Sanitize before use
If UserInput contains "../":
    Print "Invalid path detected!"
    Return

# Use absolute paths when possible
SafePath is "/home/user/data/file.txt"

# Avoid user-controlled paths
# BAD: File.Read(UserInput)
# GOOD: File.Read(SafePath)

# Never pass unsanitized user input to System.Execute
# BAD: System.Execute("ls " + UserInput)

# GOOD: Use allowlist
AllowedCommands is ["status", "version", "help"]
If AllowedCommands contains UserCommand:
    System.Execute(UserCommand)

# Validate URLs before fetching
Url is "https://trusted-domain.com/api"

# Don't trust external data
Response is HTTP.Get(Url)
# Parse and validate response before use

# Be careful with shared state in concurrent code
# Use proper synchronization
Task1 is Do in background:
    # Access shared resources carefully

SFX code runs with the same privileges as the interpreter. There is no built-in sandboxing.

The File module has unrestricted file system access. Use caution when running untrusted code.

System.Execute can run arbitrary shell commands. Never pass unsanitized user input.

The JIT compiler generates native code. While Cranelift is used, untrusted code should be reviewed.

HTTP, WebSocket, TCP, and UDP modules can access any network resource. Use firewall rules if needed.

Security fixes are released as:

• Patch releases (0.3.x) for non-breaking fixes
• Minor releases (0.x.0) for breaking security improvements
• Backports to supported versions when feasible

Stay updated:

• Watch the repository for security announcements
• Subscribe to GitHub Security Advisories
• Check the Releases page

We recognize security researchers who help improve SFX:

No reports yet - be the first!

• OWASP Top 10
• Rust Security Guidelines
• Apache 2.0 License

For security-related questions that are not vulnerabilities, you can:

• Open a GitHub Discussion
• Create an issue with the security label
• Contact: roriau@gmail.com

Thank you for helping keep SFX and its users safe!