Earlier prereleases, including 1.0.0-alpha.* (1.0.0a* on PyPI), are not supported. The unrelated npm hyperfly 0.x load balancer is not supported. Stability and versioning defines the compatibility contract.

Report privately through GitHub's private vulnerability reporting, using "Report a vulnerability" on the Security tab. Do not open public issues for vulnerabilities.

Include the package and version, a minimal payload and artifact or other reproduction, and the impact.

In scope:

• Decoder behaviour on hostile input: crashes, hangs, or memory or CPU use beyond the configured wire v0 section 6 limits.
• Artifact fingerprint verification bypass in fetchArtifact or loadArtifact (TypeScript).
• HTTP body caps and negotiation in the TypeScript and Python HTTP helpers (readBody, respond, read_body, decode_request and Accept parsing), including the bounds in negotiation v1 section 6. The Rust crate has no HTTP API.
• Cross-implementation disagreements that let one peer accept bytes another rejects in a security-relevant way.

Resource use within a deployment's configured limits, including raised limits, is out of scope; exceeding those limits is in scope. Benchmark claims and the website are out of scope.

Fixes are released as patch versions of every affected package and published as GitHub security advisories.