Packages

rusty_opus

0.3.3
0.3.3 0.3.2

Pure-Rust Opus codec for Elixir via Rustler

HexDocs Report package

Current section

Files

Jump to
Readme
2 Versions
2 Dependencies
Dependants
Files
Activity
rusty_opus SECURITY.md
Raw

SECURITY.md 

# Security policy



Report vulnerabilities privately through the repository security advisory facility at

`https://github.com/mindreframer/rusty_opus/security/advisories/new`. Do not open a

public issue or include audio content, PCM payloads, or production keys. Maintainers

will acknowledge a report, assess affected supported versions, and coordinate a fix and

disclosure.



RustyOpus runs native Rust codec code inside the BEAM through a Rustler NIF. A memory

unsafety or native abort in the codec can terminate or corrupt the VM; OTP supervision is

not an isolation boundary. Panics are contained at the NIF boundary where possible and

poison the affected codec resource, but hostile or malformed audio should be treated as

untrusted input.



Supported versions receive fixes on the latest 0.1.x line. Rust, Cargo, Hex, `opus-rs`,

and transitive dependency advisories are reviewed before releases; exact versions and the

toolchain are documented in `docs/provenance.md`. Release NIFs are built from an exact

tag and checksum-verified as described in `docs/release.md` (roadmap Epic 7). A checksum

proves artifact identity, not native-code safety.