Only the latest release receives security fixes.

Please do not open a public issue. Report privately through GitHub security advisories with:

• what is affected (endpoint, page, judge),
• steps to reproduce or a proof of concept,
• the impact you expect.

You will get an answer within 7 days. Fixes are released as soon as they are ready, and the advisory is published afterwards with credit, unless you prefer otherwise.

In scope: the API, the web client, the judge integration and the deployment configuration in this repository. Out of scope: denial of service by volume, findings that need a compromised host, and vulnerabilities in Piston itself (report those to engineer-man/piston).

Please test only against your own deployment. Do not submit code to the judge that attacks the host or other users of a deployment you do not run.

Threat model, controls and the tests that cover them: docs/security.md.