Currently, only the latest major version of Jsonlet receives security updates.

If you discover a security vulnerability in Jsonlet, do not open a public issue and do not disclose it publicly before a fix is available.

Use GitHub private vulnerability reporting. Include a clear description, affected versions, impact, reproduction steps or proof of concept, and any suggested mitigation.

You should receive an acknowledgment within 48 hours. After triage, maintainers will share the severity assessment and expected remediation timeline. Valid reports will be coordinated with the reporter through disclosure and release.

Security fixes are prepared privately, tested against supported versions, and published as a patch or minor release as appropriate. Release notes will credit reporters unless they prefer to remain anonymous.

Jsonlet is designed for trusted local application code. It relies on standard filesystem permissions.

• Not for Remote Clients: Jsonlet does not provide authentication or authorization.
• Userspace Locks: Cross-process locking relies on userspace directory CAS protocols. While heavily fenced against TOCTOU vulnerabilities, extreme event-loop starvation or network filesystem (NFS/SMB) synchronization delays may bypass mutual exclusion.
• Encryption: Jsonlet stores data as plain UTF-8 JSON. If you are storing sensitive data, implement encryption with the serialize and parse hooks and manage keys outside the database file.

Reports about unsupported versions, vulnerabilities in application code that uses Jsonlet, or risks already described as product limitations may be closed as out of scope.