Security fixes go into the latest minor release. Older release series do not receive backports; upgrade to the newest version on PyPI to get them.

Please do not open a public issue, pull request or discussion for a security problem.

Report it privately through GitHub's private vulnerability reporting on this repository. Include:

• the polyxios version, Python version and platform;
• the smallest input file or script that reproduces the problem, attached to the report rather than linked;
• what happens (crash, hang, memory growth, file written where it should not be, ...) and what you expected.

We aim to acknowledge a report within 7 days and to agree with you on a disclosure date once the issue is understood. Fixes are released as a patch version and published as a GitHub security advisory, crediting the reporter unless you ask otherwise.

polyxios reads files that often come from untrusted sources, so the parsers are the main attack surface. In scope, for example:

• memory-safety bugs in the compiled extensions (Cython modules);
• a crafted file that makes a reader allocate memory or loop out of proportion to its size, or hang;
• a reader that follows a path or reference inside a file (sidecar data, external entities, archive members) to read or write outside what the caller asked for;
• polyxios.fetcher accepting a download whose checksum does not match, or writing outside POLYXIOS_HOME.

Out of scope:

• an exception (ReadError, ValueError, ...) raised on a malformed file: refusing bad input is the intended behaviour;
• bugs in optional dependencies (h5py, netCDF4, lazrs) or in numpy, which should be reported to those projects;
• issues that require the attacker to already control the Python environment, POLYXIOS_HOME or the POLYXIOS_MODELS_URL setting.

Ordinary bugs, including wrong output on a valid file, belong in the issue tracker.