Security
Report a vulnerability privately. This page also lists every unsafe block in the code and what the CI workflows may do.
The policy file, with the supported versions, is SECURITY.md in the repository.
Report a vulnerability
Use GitHub: open the Security tab of rubtsov-stan/rift, choose "Report a vulnerability", or go straight to the advisory form. Do not open a public issue.
Include:
- the Rift version (
rift --version) and your platform; - the command line and a description of the input that triggers the problem. A pair generated with
rift-genand its seed works well; - what you expected and what happened: a crash, memory use above
--mem, a wrong diff, an out-of-bounds read.
This is a one-person project. Every report gets read, and the reply comes when there is time, without a fixed timeline.
Unsafe code
rift-gen, rift-mcp, rift-session and rift-tui forbid unsafe_code. rift-cli denies it except in two FFI modules. rift-core has one unsafe item, the counting allocator. Every block has a // SAFETY: comment, and the lint clippy::undocumented_unsafe_blocks is set to deny.
CI runs Miri on rift-core under Stacked Borrows and Tree Borrows, nightly, on demand, and on pull requests that touch crates/rift-core. The list of what Miri does not cover, and every unsafe block with its reason, is in SECURITY.md.
Workflow permissions
Every workflow sets permissions: contents: read at the top. Jobs that need more ask for it themselves. The release workflow, generated by dist, is the one exception: it sets contents: write at the top, runs only on version tags, and is not edited by hand. The site workflow gives pages: write and id-token: write to its deploy job only.