# Security Policy

MoonRule is designed to evaluate data expressions, not arbitrary code. The language has no assignment, loops, recursion, file access, network access or process execution.

## Reporting

Please report suspected vulnerabilities privately to the repository maintainer before public disclosure. Include a minimal expression and JSON input that reproduce the problem.

## Untrusted input

MoonRule provides several defense-in-depth controls for untrusted rules:

- `CompileLimits` bounds source length, AST node count, and AST depth;
- `RuleSetLimits` bounds rule count, rule names, and combined source size;
- `EvaluationLimits` applies a deterministic execution-step budget;
- `AnalysisPolicy` can reject excessive cost, depth, warnings, and dynamic regular expressions;
- `matches` rejects patterns longer than 512 characters and inputs longer than 65,536 characters.

Embedding applications must still enforce limits on total JSON input size, JSON nesting depth, collection sizes, request concurrency, and memory consumption. Resource limits should be selected for the application's own trust boundary and workload rather than relying only on MoonRule defaults.

Never include secrets in rule expressions, example data, diagnostics or public issue reports.