Use the latest released crate version or the default branch. Security fixes are not backported to older versions unless noted in a release.

This crate is pre-1.0 and under active development, so API compatibility and security support are tied to the current release line.

Please report vulnerabilities privately using GitHub private vulnerability reporting:

https://github.com/acgetchell/la-stack/security/advisories/new

Do not open a public issue for suspected vulnerabilities.

Include:

• Affected crate version or commit.
• Enabled Cargo features, especially exact if exact arithmetic is involved.
• Steps to reproduce, ideally with a minimal Rust example or test.
• Expected and observed behavior.
• Security impact, such as a panic, denial of service, or incorrect result.
• Any relevant matrix, vector, or benchmark input shape, with sensitive data removed.
• A suggested fix or mitigation, if available.

For numerical correctness issues that are not security-sensitive, open a normal GitHub issue with a minimal reproduction.

• Reports are acknowledged as maintainer availability allows.
• The issue is triaged and its severity assessed on a best-effort basis.
• Accepted reports receive updates when there is meaningful progress or a material change in the assessment.
• For an accepted vulnerability, the project prepares a fix, publishes a GitHub Security Advisory, releases the fix, and requests a RustSec advisory when appropriate.
• If a report is declined, the reporter receives an explanation.

Please follow coordinated disclosure and avoid public disclosure until a fix or mitigation is available.

The crate uses #![forbid(unsafe_code)], which reduces memory-safety risk. Security-relevant correctness and availability issues can still exist. In scope are:

• Panics or crashes triggered by malformed or adversarial matrices or vectors.
• CPU or memory denial of service caused by crafted inputs, including inputs to optional exact-arithmetic paths.
• Incorrect numerical results that affect security, data integrity, or availability when processing untrusted input.
• Violations of documented exact-arithmetic guarantees, such as silent precision loss, when they have a security impact.

Out of scope are:

• Documented floating-point limitations, conditioning behavior, or rounding bounds that do not create a security impact.
• Performance limitations that are not exploitable as denial of service.
• Issues caused by use outside the documented API contracts or supported problem scope.

• Fixes are released on the latest supported release line. Older releases receive fixes only when explicitly noted.
• Releases are published to crates.io with corresponding GitHub releases.
• Accepted vulnerabilities are documented with GitHub Security Advisories and, when appropriate, RustSec advisories.
• Public technical detail may be limited until users have had a reasonable opportunity to update.

Applicable vulnerabilities may be disclosed through the RustSec Advisory Database, enabling detection with cargo audit.

Good-faith security research is welcome. Avoid privacy violations, data destruction, persistence, service disruption, and public disclosure before a fix or mitigation is available. Reports that follow coordinated disclosure and make a reasonable effort to avoid harm are treated as helpful contributions.

Responsible disclosure is appreciated. Reporters may be credited in advisories or release notes unless anonymity is requested.

This project uses GitHub CodeQL, Dependabot security updates, secret scanning with push protection, cargo audit, zizmor, Clippy SARIF analysis, and repository-owned Semgrep rules.

just security adds shared OSV dependency auditing and Gitleaks scans of reachable Git history and current tracked/nonignored files. Both use declared managed binaries installed by shared setup and retain redacted JSON/SARIF reports under target/security. See the contributor workflow for the separate scan commands and prerequisites.

Gitleaks flags a historical compatibility alias in scripts/bench_compare.py at commit d8f9897f59cce0a220efdbbcbaaf9180861889e9. The alias assigns one Python identifier to another; the assignment contains no credential. .gitleaks.toml retains the default detectors and permits only this exact assignment in that file. Other assignments and paths remain checked.

Semgrep 1.178.0 requires pyjwt[crypto]~=2.13.0, which retains packages affected by the PyJWT advisories reported by OSV. The uv override in pyproject.toml preserves the crypto extra and selects pyjwt>=2.15.1,<3; uv.lock records the resolved version. Remove the override when the pinned Semgrep release accepts the patched PyJWT versions. Validate native Semgrep scans after either change.

CodeQL's rust/cleartext-logging query uses name-based heuristics to identify potentially sensitive data. Here, Matrix::certified_error_bound and the benchmark helper's certified_bound refer to numerical rounding-error bounds. They contain no credentials, cryptographic certificates, or personal information.

Alerts #171–#178 were reviewed against commit bd80cc05df3ebf409d8db9a471b671a5737bf0c4: their sinks are assertion or panic diagnostics for deterministic test and benchmark fixtures. These individual alerts were dismissed as false positives with that rationale. Keep the query enabled and preserve diagnostic values needed to investigate numerical failures. Review new alerts on their own data flow.

As of October 1, 2026, paste 1.0.15 enters through the development dependency faer 0.24.4, via gemm 0.19.0 and pulp 0.22.3. Those are the latest published upstream versions checked on that date. Repository-owned Rust code already uses pastey; changing that direct dependency cannot replace upstream uses of paste.

RUSTSEC-2024-0436 is an unmaintained-package advisory with no patched version. It is a genuine maintenance concern, separate from the logging false positives. paste is absent from the library's normal and build dependency graph, including with exact enabled, but its procedural macro executes when building development targets.

The root osv-scanner.toml temporarily accepts only RUSTSEC-2024-0436 until January 1, 2027, when OSV resumes blocking on it. This is a documented acceptance of the maintenance risk, not a patched dependency. Native OSV configuration discovery applies it to the root lockfiles scanned by just security; paste remains in the package inventory, and all other advisories remain enabled.

Keep this advisory visible in cargo audit. Recheck the dependency path with cargo tree --locked --workspace --all-features -i paste when updating faer, gemm, or pulp. Remove both the dependency and its OSV exception through a maintained upstream release when available; reassess explicitly before extending the exception.