Glyd

Security policy

From SECURITY.md in the repository, copied Sep 27, 2026.

Supported versions

Fixes go into the latest release. Streams written by any earlier release keep decoding with it (see docs/spec.md), so upgrading is the fix for every version.

Reporting a vulnerability

Please do not open a public issue. Report it privately, either way:

Include the version (glyd --version), the input that triggers it (or how to make it), and what happens.

The decoders read untrusted bytes, so on any input these are security bugs: a crash or panic, a hang, an out-of-bounds read or write, memory growing without bound, or a round trip that returns different bytes without an error. The same holds for glyd-store reading its metadata and objects.

After a report

The fix ships in a release with a GitHub security advisory describing it. Reporters are credited in the advisory unless they ask not to be.