The supported security surface consists of these primary areas:

• proa_core
• proa_dsl
• proa_macros
• proa_stream
• proa_framework_core
• proa_framework_axum
• rsjs, rsjs_ir, and rsjs_macros
• proa_cli

Experimental demos, benchmark fixtures, generated showcase assets, and downstream applications may not receive the same response expectations.

Please report suspected vulnerabilities privately. Do not open a public issue with exploit details.

Report through the Security tab of this repository on GitHub, using Report a vulnerability. That opens a private security advisory visible only to you and the maintainers, so the report stays confidential until a fix ships.

Include:

• affected crate or app
• affected version or commit
• reproduction steps
• expected impact
• any suggested fix or mitigation

There is no security mailbox. GitHub advisories are the only reporting channel, which keeps the report, the discussion, and the eventual advisory in one place.

Security fixes should be prepared privately until a patch is available. Public advisories, credits, and timelines will be decided case by case.