# Security policy

## Processing untrusted deltas

VCDIFF can describe output much larger than its input. Always select a
`DecodeLimits` policy appropriate for the surrounding application. The
`Service` profile is the library default; smaller embedded or interactive
limits are available, and every field can be set explicitly.

The decoder enforces:

- maximum cumulative output bytes;
- maximum bytes in one target window;
- maximum window count;
- maximum semantic instructions per window;
- checked integer additions and section boundaries;
- dictionary and COPY address bounds;
- exact consumption of data, instruction, and address sections.

`inspect` and `trace` validate structure without source contents. `audit` is a
non-throwing entry point that separates structural validity from
source-dependent decodability and includes conservative peak-memory figures.
Do not treat inspection alone as proof that a source-dependent delta can be
decoded with a particular source.

## Error handling

All format failures use `VcdiffError`, a stable category code, a concise
message, and the most specific byte offset available. The CLI exits with code
2 for malformed/unsupported data and verification mismatch. It never writes a
decoded output after a decoding exception.

## Reporting vulnerabilities

Please open a private GitHub security advisory for the repository rather than
publishing an exploit in a regular issue. Include the MoonBit version, target
backend, minimal delta bytes, expected limit, and observed behavior. Public
compatibility bugs that do not expose users may use a normal issue.

The maintainers will acknowledge a report, reproduce it against the stable
toolchain, prepare regression tests, and coordinate disclosure before release.