This document specifies the security process for the swift-nio-quic project.

swift-nio-quic is in early development and carries no tagged release yet. Until a 1.0, security fixes land on main, and there is no released version line to back-port to. This section will name the supported version range once the project tags its first release, following the pattern the SwiftNIO security policy sets for the ecosystem.

If you believe that you have found a security or privacy vulnerability in swift-nio-quic, please report it through GitHub’s private vulnerability reporting rather than opening a public issue. A report should name the affected commit, describe the behavior you observed and the behavior you expected, give the steps to reproduce it, and include a proof of concept or an exploit where you have one.

The maintainers will try to acknowledge a report within 7 days. That acknowledgment is neither acceptance nor rejection of the report. The maintainers may follow up with questions, or invite you to work through the details.

Keep these guidelines in mind:

• A known, publicly disclosed CVE can be reported as an ordinary issue.
• Output from an automated scanner or a fuzzer must carry the context that demonstrates a vulnerability, with a proof of concept or a working exploit. swift-nio-quic runs a libFuzzer harness over the wire codec and the packet-protection open path, so a raw crash on malformed input is handled as an ordinary bug unless it is shown to affect other processes on the system.
• An application crash on malformed input is not by itself treated as a security vulnerability, unless it is shown to also affect other processes on the system.