Use the latest released crate version or the default branch. Security fixes are not backported to older versions unless noted in a release.

This crate is pre-1.0 and under active development, so API compatibility and security support are tied to the current release line.

Please report vulnerabilities privately using GitHub private vulnerability reporting:

https://github.com/acgetchell/la-stack/security/advisories/new

Do not open a public issue for suspected vulnerabilities.

Include:

• Affected crate version or commit.
• Enabled Cargo features, especially exact if exact arithmetic is involved.
• Steps to reproduce, ideally with a minimal Rust example or test.
• Expected and observed behavior.
• Security impact, such as a panic, denial of service, or incorrect result.
• Any relevant matrix, vector, or benchmark input shape, with sensitive data removed.
• A suggested fix or mitigation, if available.

For numerical correctness issues that are not security-sensitive, open a normal GitHub issue with a minimal reproduction.

• Reports are acknowledged as maintainer availability allows.
• The issue is triaged and its severity assessed on a best-effort basis.
• Accepted reports receive updates when there is meaningful progress or a material change in the assessment.
• For an accepted vulnerability, the project prepares a fix, publishes a GitHub Security Advisory, releases the fix, and requests a RustSec advisory when appropriate.
• If a report is declined, the reporter receives an explanation.

Please follow coordinated disclosure and avoid public disclosure until a fix or mitigation is available.

The crate uses #![forbid(unsafe_code)], which reduces memory-safety risk. Security-relevant correctness and availability issues can still exist. In scope are:

• Panics or crashes triggered by malformed or adversarial matrices or vectors.
• CPU or memory denial of service caused by crafted inputs, including inputs to optional exact-arithmetic paths.
• Incorrect numerical results that affect security, data integrity, or availability when processing untrusted input.
• Violations of documented exact-arithmetic guarantees, such as silent precision loss, when they have a security impact.

Out of scope are:

• Documented floating-point limitations, conditioning behavior, or rounding bounds that do not create a security impact.
• Performance limitations that are not exploitable as denial of service.
• Issues caused by use outside the documented API contracts or supported problem scope.

• Fixes are released on the latest supported release line. Older releases receive fixes only when explicitly noted.
• Releases are published to crates.io with corresponding GitHub releases.
• Accepted vulnerabilities are documented with GitHub Security Advisories and, when appropriate, RustSec advisories.
• Public technical detail may be limited until users have had a reasonable opportunity to update.

Applicable vulnerabilities may be disclosed through the RustSec Advisory Database, enabling detection with cargo audit.

Good-faith security research is welcome. Avoid privacy violations, data destruction, persistence, service disruption, and public disclosure before a fix or mitigation is available. Reports that follow coordinated disclosure and make a reasonable effort to avoid harm are treated as helpful contributions.

Responsible disclosure is appreciated. Reporters may be credited in advisories or release notes unless anonymity is requested.

This project uses GitHub CodeQL, Dependabot security updates, secret scanning with push protection, cargo audit, zizmor, Clippy SARIF analysis, and repository-owned Semgrep rules.

CodeQL's rust/cleartext-logging query uses name-based heuristics to identify potentially sensitive data. Here, Matrix::certified_error_bound and the benchmark helper's certified_bound refer to numerical rounding-error bounds. They contain no credentials, cryptographic certificates, or personal information.

Alerts #171–#178 were reviewed against commit bd80cc05df3ebf409d8db9a471b671a5737bf0c4: their sinks are assertion or panic diagnostics for deterministic test and benchmark fixtures. These individual alerts were dismissed as false positives with that rationale. Keep the query enabled and preserve diagnostic values needed to investigate numerical failures. Review new alerts on their own data flow.

As of September 7, 2026, paste 1.0.15 enters through the development dependency faer 0.24.4, via gemm 0.19.0 and pulp 0.22.3. Those are the latest published upstream versions checked on that date. Repository-owned Rust code already uses pastey; changing that direct dependency cannot replace upstream uses of paste.

RUSTSEC-2024-0436 is an unmaintained-package advisory with no patched version. It is a genuine maintenance concern, separate from the logging false positives. paste is absent from the library's normal and build dependency graph, including with exact enabled, but its procedural macro executes when building development targets.

Keep this advisory visible in cargo audit. Recheck the dependency path with cargo tree --locked --all-features -i paste when updating faer, gemm, or pulp, and remove the dependency through a maintained upstream release when available.