codechu-config reads and writes configuration files on disk. Its public API parses JSON / TOML, validates against a caller-supplied schema, and writes atomically. It performs no network I/O and does not execute caller-supplied code other than the migration callables the caller themselves passes in.

Pre-1.0.0 — only the latest minor receives security fixes.

Open a private advisory at github.com/codechu/codechu-config-py/security/advisories/new.

Write to security@codechu.com.

In scope:

• Malformed JSON / TOML input that crashes the parser with an uncaught exception (we want ConfigError, never a bare traceback).
• Atomic-save failures that leave the original file truncated, corrupted, or replaced with partial content.
• Path traversal or symlink-escape via the path argument when the parent directory is attacker-controlled.
• Resource exhaustion via deeply-nested input that bypasses Python's recursion guard.

Out of scope:

• Schema-design mistakes by the caller (e.g. a permissive Field() that accepts unexpected types). Tighten the schema.
• Migrations are caller-supplied callables — bugs there are the caller's responsibility.

Reports are reviewed on a best-effort basis — no fixed SLA. We aim for coordinated disclosure within 90 days of the report.

Public disclosure is coordinated after the fix is released.

Once a confirmed fix is released:

• A summary is added to the CHANGELOG under the ### Security category.
• A GitHub Security Advisory is published.
• If a CVE was assigned, its number is referenced.