Source: SECURITY.md · Edit on GitHub

Security policy — lean-grpc

Reporting a vulnerability

Do not open a public GitHub issue for security-sensitive reports.

  1. Email security@rileybetts.ai with subject prefix [SECURITY] lean-grpc.
  2. Include: affected revision, impact, reproduction steps, and any proposed fix.
  3. Allow a reasonable window for a patch or advisory before public disclosure.

You may also open a private GitHub Security Advisory when that channel is enabled.

Supported versions

Security fixes apply to the latest tagged release (e.g. v1.0.0). There is no long-term LTS train yet.

Current posture

Post-hardening (2026-08 audit follow-up): TLS peer + hostname verification, compression caps, HTTP/2 flow-control and header-list limits, and dual-gated insecure env overrides are in place. CI gates include securityTests and ASAN scripts. Selected pure-codec theorems ship under Proofs/ (lake build Proofs).

Still prefer defense in depth for high-risk deployments: network policy, sidecar TLS where appropriate, and application-layer authn/z. OpenSSL and helper processes remain a trusted TCB — not an end-to-end TLS/gRPC proof.

Known limitations

  • ALTS and GCE channel credentials are not implemented (allowlisted).
  • HTTP CONNECT proxying is not implemented.
  • Huffman decode-trie rewrite and full xDS bootstrap JSON rewrite remain follow-ups (mitigated by existing caps).

Full audit narrative and remediation table: security-review-2026-08.md on GitHub. In-repo policy: SECURITY.md. Provenance: docs/provenance.md.