histodiff is pre-1.0 (the 0.x series) and publishes a single line of releases - there is no long-term-support branch. Security fixes are made against main and released as the next 0.x version.

If you're on an older release, please upgrade before reporting an issue; a fix will only be backported in unusual circumstances (for example, an actively exploited vulnerability with no other mitigation).

Please do not open a public GitHub issue for a suspected security vulnerability. A public issue discloses it to everyone, including anyone who might exploit it, before a fix exists.

Instead, please use GitHub's private vulnerability reporting for this repository:

1. Go to the repository's Security tab.
2. Click "Report a vulnerability".
3. Describe the issue, the affected version(s), and, if you can, a minimal reproduction.

This opens a private advisory visible only to you and the maintainers, with its own discussion thread, until a fix is ready and you agree to disclose it.

histodiff is a text-diffing library and CLI: it reads two files, or two sequences in Python, and produces a description of their differences. Worth reporting privately, for example:

• A crash, hang, or excessive memory/CPU use triggered by untrusted input, beyond what's already documented in the README's Limitations and Performance sections - for example, a way to hit worst-case behavior far more cheaply than the documented cost, or exhaust memory on a small input.
• Any way that diffing two inputs could execute code, or read or write files other than the ones explicitly passed in.
• A vulnerability in a dependency that affects histodiff specifically. Note that histodiff itself has no runtime dependencies; this would most likely concern the dev extra or the build/release toolchain instead.

Bugs that only affect diff quality - an unexpected alignment, a diff that's larger or less readable than expected - are not security issues. Please file those as a normal bug report instead.

These are best-effort targets from an unpaid open-source project, not a contractual SLA:

• Acknowledge a new report within 5 business days.
• Provide an initial assessment - confirmed, not a security issue, or more information needed - within 10 business days of acknowledgment.
• Once a fix is ready, coordinate a release and, unless you ask otherwise, credit you in the release notes and/or a GitHub Security Advisory.