扩展指标

2026-07-09 05:08:16 +08:00
commit 308c46ab9a
537 changed files with 152299 additions and 0 deletions
@@ -0,0 +1,43 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+| ------- | --------- |
+| latest  | ✅        |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in ferro-ta, please **do not** open a
+public GitHub issue.
+
+Instead, report it privately by emailing **pratikbhadane24@gmail.com** with:
+
+- A description of the vulnerability
+- Steps to reproduce (or a minimal proof-of-concept)
+- The potential impact
+
+You will receive a response within 7 days acknowledging receipt, and a
+follow-up within 14 days with next steps.
+
+We will coordinate a fix and public disclosure together. We appreciate
+responsible disclosure and will credit researchers who report issues in good
+faith.
+
+## Scope
+
+ferro-ta is a numerical computation library. Security-relevant concerns include:
+
+- Memory safety issues in the Rust extension (buffer overflows, use-after-free,
+  etc.)
+- Unsafe behaviour triggered by crafted input arrays
+- Dependency vulnerabilities (tracked via `cargo audit` and Dependabot)
+
+Out of scope: issues in user code that calls ferro-ta, or theoretical attacks
+that require direct file-system or network access.
+
+## Hardening and audits
+
+- **Fuzzing:** The project runs `cargo fuzz` targets (e.g. `fuzz_sma`, `fuzz_rsi`) in CI. Crashes are treated as failures; artifacts are uploaded for investigation.
+- **Dependency audits:** CI runs `cargo audit` (Rust) and `pip-audit` (Python). Critical and high-severity vulnerabilities should be addressed before release.
+- **Reporting:** If you have performed a security assessment or audit, we welcome a private summary to the contact above.