Published whole, out of SECURITY.md, 15 lines.
This is a pre-release fork of Crystal and it has no users to protect yet. It is not built for production and the README says so.
If the issue is in Crystal, which is most of this code, report it to Crystal: [email protected]. That is their mailbox and their process, and it reaches everybody the bug actually affects.
If the issue is in what this fork added — the .iyimod artifact reader, the import path, the rules in SPEC.md — open a private security advisory on this repository, or an ordinary issue if it is not sensitive. A malformed or hostile .iyimod is the interesting case: the reader is the one place here that parses something a program did not write itself.
The rest
- ContributingWhat a change to this repository is expected to come with.
- Contributor Covenant Code of ConductThe Contributor Covenant, and the address that enforces it here.
- Crystal Programming LanguageCrystal's copyright, the license, and every library the compiler links.