Security Policy

Supported versions

NovaLang is currently pre-release software. Until 0.2.0-alpha.1 is published, only the latest commit on main receives security fixes. After publication, the latest 0.2.x alpha will be supported; older alphas may require upgrading.

Pre-release support means best-effort remediation and does not imply a production-stability guarantee.

Reporting a vulnerability

Do not disclose a suspected vulnerability in a public issue, discussion, pull request, or chat.

Send the report privately to joaoantpre@gmail.com with a subject beginning with [NovaLang Security]. Include affected versions, platform, impact, reproduction steps or a proof of concept, and any suggested mitigation.

You should receive an acknowledgement within 7 days and an initial assessment within 14 days. Timelines may vary because the project is currently maintained by a small team. Please allow time for a coordinated fix before disclosure.

Security scope

Reports about parser/compiler crashes on untrusted input, unsafe package handling, path traversal, arbitrary code execution, memory corruption, dependency confusion, malicious bytecode, and denial of service are in scope. The NovaLang compiler and runtime are not yet a security sandbox: executing untrusted NovaLang programs is unsafe unless isolated by the operating system.