Please do not report security vulnerabilities through public GitHub issues, pull requests, or the Discord server.

Report them privately through GitHub's private vulnerability reporting:

https://github.com/neyuki-lang/neyuki/security/advisories/new

Please write up and copy your report before opening it. It's much quicker for us to process reports that arrive complete than to wait for details to trickle in. Make sure it contains the following:

Summary

• What's broken and why it matters. "Integer overflow in bigint conversion leads to memory corruption" is useful; "crash" is not.

Reproduction steps

• A minimal .nyk script (or Rust snippet) that triggers the issue, with everything not needed stripped out.
• The exact commands you ran (e.g. cargo run -- run poc.nyk).
• Expected vs. actual behaviour.

Severity and impact

• What can an attacker actually do? (crash, memory corruption, data disclosure, code execution, ...)
• Who is affected: does it require untrusted input, a specific build flag, a specific library, a specific target platform?

Environment

• Neyuki version or commit hash.
• OS and architecture.
• Rust toolchain version and any build flags or relevant configuration.

Root cause (if known)

• Where in the code the bug lives and why it happens, plus a suggested fix if you have one.

Proof of concept

• Crash log, panic message and backtrace (RUST_BACKTRACE=1), or a screenshot/GIF for anything visual.

We will acknowledge the report as soon as we can, keep you informed while we work on a fix, and credit you in the advisory unless you prefer to stay anonymous. Please give us a reasonable amount of time to release a fix before disclosing publicly.

Neyuki is pre-1.0 and things are still moving quickly, but the following are always treated as security issues:

• memory unsafety (crashes, use-after-free, out-of-bounds reads/writes) in the VM, garbage collector or any native library reachable from a .nyk script
• bugs in @neyuki/crypto that weaken hashing, password hashing, encryption, signatures or random number generation
• bugs in @neyuki/sql that allow parameterized queries to be turned into SQL injection
• bugs in @neyuki/http that allow request smuggling, header injection, TLS verification bypass or path traversal in the server
• any way for a script to gain capabilities that the runtime is documented as not granting it

• Running untrusted scripts. Neyuki is not a sandbox. Scripts have access to the filesystem, network and OS through the bundled libraries, so a malicious .nyk file can do anything the user running it can do. Do not run scripts you do not trust.
• Denial of service through scripts that intentionally allocate unbounded memory or loop forever.
• Vulnerabilities in third-party dependencies that are already reported upstream. Please report those to the crate's maintainers; a PR bumping the dependency is welcome.

Only the latest release and the main branch receive security fixes.

If you are unsure whether something is a security issue, ask privately through the advisory link above rather than in public. For everything else, the Discord server is the place: https://discord.gg/mvCB3KnAT4