ferro-ta/SECURITY.md

Security Policy

Supported Versions

Version	Supported
latest	✅

Reporting a Vulnerability

If you discover a security vulnerability in ferro-ta, please do not open a public GitHub issue.

Instead, report it privately by emailing pratikbhadane24@gmail.com with:

• A description of the vulnerability
• Steps to reproduce (or a minimal proof-of-concept)
• The potential impact

You will receive a response within 7 days acknowledging receipt, and a follow-up within 14 days with next steps.

We will coordinate a fix and public disclosure together. We appreciate responsible disclosure and will credit researchers who report issues in good faith.

Scope

ferro-ta is a numerical computation library. Security-relevant concerns include:

• Memory safety issues in the Rust extension (buffer overflows, use-after-free, etc.)
• Unsafe behaviour triggered by crafted input arrays
• Dependency vulnerabilities (tracked via cargo audit and Dependabot)

Out of scope: issues in user code that calls ferro-ta, or theoretical attacks that require direct file-system or network access.

Hardening and audits

• Fuzzing: The project runs cargo fuzz targets (e.g. fuzz_sma, fuzz_rsi) in CI. Crashes are treated as failures; artifacts are uploaded for investigation.
• Dependency audits: CI runs cargo audit (Rust) and pip-audit (Python). Critical and high-severity vulnerabilities should be addressed before release.
• Reporting: If you have performed a security assessment or audit, we welcome a private summary to the contact above.