The Arandu project takes the security of its software and repository CI seriously. Our security process follows the principle of Coordinated Vulnerability Disclosure.

Please do not report security vulnerabilities through public GitHub issues.

Instead, use the repository's private security advisory feature:

1. Go to the affected repository and open Security → Security advisory → New draft security advisory.
2. Fill in the impact and a description.
3. You can optionally credit the report; drafts are only visible to maintainers until you submit.

If the affected repository does not have private advisories enabled yet, contact the maintainers through the GitHub org (@arandu-lang) and reference that you wish to report a security issue privately.

To help us triage and reproduce the issue faster, include as much as possible:

• Type of issue (e.g. compiler crash, memory unsafety, code generation bug).
• Full paths of source file(s) related to the manifestation of the issue.
• The affected version/tag/commit or a direct URL.
• Any special configuration required to reproduce.
• Step-by-step instructions to reproduce.
• Proof-of-concept (if possible).
• Impact, including how an attacker might exploit the issue.

Arandu is an experimental language with a rapidly moving compiler. Support is limited to the latest published release and repository main:

Because the language and toolchain are pre-1.0, fixes ship in the next release — there is no maintained security patch branch.

• A maintainer will triage your report and confirm receipt, typically within 5 business days.
• We will coordinate a disclosure date and do not share the details before a fix is available.
• If the issue is accepted, a fix is prepared and released; the advisory can be published with credit to the reporter unless they prefer to stay anonymous.

English is preferred, but reports in Portuguese (pt-BR) are welcome.

This policy covers the repositories in the arandu-lang organization. Anything outside those repositories (third-party dependencies, external toolchains) is out of scope; report those to their respective maintainers.