During the alpha phase, only the latest alpha release receives security fixes. No LTS or multi-version support is provided before 0.1.0 stable.

Use GitHub's private vulnerability reporting to create a security advisory:

https://github.com/easy-4-rust/easydoc-rust/security/advisories/new

This is a confidential channel. Only repository maintainers and the reporter can see the advisory until it is published. You will receive an acknowledgement within 48 hours.

For sensitive reports that cannot use GitHub Security Advisories:

security@easydoc-rust.example.com

Note: This is a placeholder address. Check the repository for the current contact email before sending.

For issues that are not security-sensitive (typo, build failure, feature request), use the public issue tracker:

https://github.com/easy-4-rust/easydoc-rust/issues/new

Do not report security vulnerabilities through public issues.

A good vulnerability report should contain:

• Description -- what is the vulnerability and how it can be exploited
• Reproduction steps -- minimal test case or sequence of inputs
• Affected versions -- which releases and platforms are impacted
• Known mitigations -- any workarounds or configuration changes that reduce risk
• Severity assessment -- your estimate (Critical / High / Medium / Low)

If a fix cannot meet these timelines, we will communicate the revised schedule through the advisory.

Security fixes are announced through:

• GitHub Security Advisories -- primary channel, confidential until disclosure
• CHANGELOG.md -- all security-related changes are noted
• GitHub Releases -- patched versions are published with release notes

To receive release notifications only, configure your watch settings:

Watch > Custom > check Releases

This project applies the following security practices:

• #![deny(unsafe_code)] across all 9 workspace crates -- no unsafe blocks in production code

• cargo-audit -- RustSec advisory database checks (CI + weekly schedule)
• cargo-deny -- license allowlist, banned crates, source restrictions (crates.io only), advisory integration

• MSRV: Rust 1.88.0 (declared in rust-toolchain.toml)
• License: Apache-2.0 (enforced via cargo-deny allowlist)
• Clippy: pedantic lint group enabled, -D warnings in CI
• Formatting: cargo fmt --check enforced in CI

We credit security researchers who follow responsible disclosure. If you report a confirmed vulnerability, we will add your name here (with your permission).

• (none yet)

• Rust Security Advisory Database (RustSec)
• cargo-audit documentation
• cargo-deny documentation
• GitHub Security Advisories