If you discover a security vulnerability in Assura, please report it responsibly through GitHub Security Advisories.

Do not open a public issue for security vulnerabilities.

• Description of the vulnerability
• Steps to reproduce (a minimal .assura file if applicable)
• Impact assessment (what an attacker could achieve)
• Affected component (parser, codegen, SMT encoding, CLI, etc.)

• Acknowledgment: within 48 hours
• Initial assessment: within 1 week
• Fix or mitigation: depends on severity, targeting 30 days for critical issues

The following are in scope for security reports:

• Parser crashes or panics on malformed input
• Code generation that produces unsafe Rust from safe contracts
• SMT encoding errors that cause unsound verification (compiler says "verified" but the contract is actually violated)
• Command injection or path traversal in CLI commands
• Dependency vulnerabilities in the supply chain

• Denial of service via expensive SMT queries (expected; use --timeout)
• Issues in generated Rust code that rustc would independently catch