Basalt is an educational, embedded database engine. Please read this before reporting — the threat model matters for what counts as a vulnerability.

Basalt is meant to run locally / embedded:

• The hydb/basalt CLIs and the embedded library run in your own process.
• The server + Workbench are a localhost developer tool. There is no authentication, no access control, and no network hardening — this is documented, not a bug. Do not expose server to an untrusted network or the public internet. Bind it to 127.0.0.1 (the default) and put it behind your own auth/proxy if you need remote access.
• The WASM playground runs entirely in the visitor's browser on an in-memory demo database — nothing is sent to a server.

Auth, roles, and grants are a deliberate future item — see ROADMAP.md (Tier 4).

Even for a local engine, these are real and worth reporting privately:

• Memory-safety bugs: buffer overflows, use-after-free, out-of-bounds reads/writes in the parser, executor, or storage layer (e.g. a crafted query or a corrupt on-disk catalog that leads to memory corruption).
• On-disk format bugs that let a malicious database directory crash or corrupt the process when opened.
• SQL parser crashes/hangs on adversarial input (DoS of the local process).
• Any way the server can be made to read/write files outside its served database directory (path traversal), when reached from localhost.

Plain incorrect query results are correctness bugs, not security issues — please open a normal issue for those.

Please report privately first — do not open a public issue for a memory-safety or corruption bug.

1. Use GitHub's Private vulnerability reporting (repo → Security tab → Report a vulnerability). This keeps the report confidential until a fix ships.
2. Include: the SQL / schema / on-disk state to reproduce, what happens vs. what you expected, the commit/branch, and OS/compiler. A reproducer built with -fsanitize=address,undefined is ideal.

This is a volunteer, best-effort project — there's no SLA, but we aim to:

• Acknowledge your report within about a week.
• Discuss and confirm the issue with you.
• Fix it and, if you'd like, credit you in the release notes / advisory.

Because there are no long-term supported release branches yet, fixes land on main. If Basalt starts publishing versioned releases, this section will list which are supported.

Thank you for helping keep Basalt safe to hack on.