surma
d44f1d9677
Checkpoint before integration and package validation. Assisted-by: SurmAgent:unknown [read] [edit] [bash]
15 lines
723 B
Markdown
15 lines
723 B
Markdown
# Security Policy
|
|
|
|
We no longer accept private security reports nor issue CVEs. Please file bug
|
|
reports in the [issue tracker](https://github.com/quickjs-ng/quickjs/issues).
|
|
|
|
## Out of Scope
|
|
|
|
**Bytecode hardening is out of scope.** QuickJS bytecode is not designed for
|
|
adversarial input. Loading untrusted bytecode (e.g. via `JS_ReadObject` with
|
|
`JS_READ_OBJ_BYTECODE`) is equivalent to executing untrusted native code, and
|
|
crashes, memory corruption, or sandbox escapes resulting from malformed or
|
|
malicious bytecode are not considered security vulnerabilities. Only load
|
|
bytecode you produced yourself or obtained from a trusted source. See the
|
|
documentation for `JS_READ_OBJ_BYTECODE` and `JS_READ_OBJ_SAB` for details.
|