The main branch is under active development. The latest tagged release is the only version that receives security fixes.

Please do not file a public GitHub issue for security vulnerabilities.

Email the maintainers directly at security@example.com (placeholder — replace with a real address before release). You can expect an acknowledgement within 48 hours, and a fix in the next release depending on severity.

If you prefer to stay anonymous, please still reach out — the details of the bug matter more than your identity.

• WASAPI device handling (aurora-core/src/wasapi/): parsing of untrusted WAVEFORMATEX structures from the OS audio stack. These are treated as potentially misaligned and bounds-checked.
• Lock-free ring buffer (aurora-core/src/ring.rs): real-time safety of the producer/consumer exchange; out-of-bounds access here could crash the audio thread.
• Native FFI (windows crate): only the documented COM interfaces are used; all pointers are validated before use.

1. Reporter contacts maintainers privately.
2. Maintainers triage, confirm, and prepare a patched release.
3. Once the fix is published, a coordinated advisory is released.

Dependencies are scanned weekly via cargo-deny (see .github/workflows/deny.yml) for known vulnerabilities, unmaintained crates, and license compliance. Any deny finding blocks CI.