We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

DO NOT create a public GitHub issue for security vulnerabilities.

Instead, please email security vulnerabilities to:

• Email: security@daemoniorum.com

Please include the following in your report:

1. Description - A clear description of the vulnerability
2. Impact - What could an attacker accomplish?
3. Reproduction Steps - Step-by-step instructions to reproduce the issue
4. Affected Component - Which crate(s) are affected
5. Version - What version(s) are affected
6. Suggested Fix - If you have one (optional)

• Initial Response: Within 48 hours
• Triage Complete: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: 7 days
  • High: 14 days
  • Medium: 30 days
  • Low: 60 days

1. Acknowledgment - We'll confirm receipt of your report
2. Investigation - We'll investigate and determine the impact
3. Fix Development - We'll develop and test a fix
4. Coordinated Disclosure - We'll work with you on disclosure timing
5. Credit - We'll credit you in the security advisory (if desired)

• Validate sample rates and buffer sizes before processing
• Use bounded buffers to prevent memory exhaustion
• Sanitize user-provided parameters (frequencies, gains, etc.)
• Avoid unbounded loops in real-time audio paths

• Validate all data crossing the WASM boundary
• Use SharedArrayBuffer only with proper CORS headers
• Limit memory allocation in AudioWorklet context

• Use exclusive audio mode only when needed
• Properly release audio device handles
• Validate plugin/extension integrity before loading

• Denial of Service: Malicious audio graphs could exhaust CPU. Implement processing budgets.
• Memory Safety: Lock-free data structures require careful implementation to avoid data races.

• Cross-Origin Isolation: SharedArrayBuffer requires specific headers
• Memory Limits: WASM memory can be exhausted by malicious input

We regularly audit dependencies for known vulnerabilities using:

• cargo audit
• cargo deny
• Dependabot alerts

For non-vulnerability security questions, you can reach us at:

• General: hello@daemoniorum.com
• Security: security@daemoniorum.com