Skip to content

Security: fixpoint-linux/shen-meta

Security

SECURITY.md

Security

Reporting a vulnerability

If you discover a security issue in shen-meta, please report it via jmars/security-advisories or email directly.

Do not open a public issue for security-sensitive bugs.

Scope

The C VM (vm/zincvm.c) runs bytecode generated by the meta-circular Shen compiler. While the VM is sandboxed by design (no system(), no exec(), no network primitives), bugs in the GC or buffer handling could be exploitable.

Best practices for contributors

  • Keep the VM surface minimal. New primitives should be pure when possible.
  • Fuzz edge cases in bytecode parsing and bundle loading.
  • The GC is the highest-risk component — conservative, manual integration.

There aren't any published security advisories