The latest GitHub Release is supported. Before stable 1.0, fixes ship on the current 0.x line without backport guarantees.

Use GitHub private vulnerability reporting. Do not open a public issue containing an exploit. Include the BendSeq version, platform, minimal input, command, observed result, and expected boundary. Expect acknowledgement within seven days; fix and disclosure timing depends on severity.

BendSeq parses untrusted JSON and writes into a caller-selected new directory. It does not access the network, invoke subprocesses, load plugins, or execute job content. Inputs are bounded, report text is escaped, and existing output paths are not overwritten.

Those properties do not make a physical sequence safe. Machine operation requires qualified human verification and is outside the software security boundary.