# Security Policy
### Supported Versions

- lastest

As an early-stage crate, only the latest published version receives security fixes. No backports are planned unless a critical vulnerability warrants it.

### Scope

BetterResult is a pure Rust error handling library with no I/O, no network access, no unsafe blocks, and no external dependencies. The attack surface is limited to:

- **Macro expansion correctness** - `better_error!` and `chain_up!` generate code at compile time. A malformed macro output could produce unsound behaviour in the caller's crate.
- **Panic behaviour** - unreachable arms in the state machine panic rather than returning errors. A bug in the state transition logic could cause unexpected panic in production.
- **Type safety invariants** - the sealed state machine enforces chain correctness at compile time. A bypass of these invariants would be considered a security-relevant soundness bug.

Supply chain attacks and memory safety vulnerabilities are out of scope given the zero dependency, no-unsafe design.

### Reporting a Vulnerability

If you find a bug, logic error in macro expansion, or any issue that could cause undefined behaviour or incorrect chaining, please report it privately before opening a public issue.

**Contact**: open a GitHub Security Advisory on this repository

Please include:

- A minimal reproducer (code snippet or test case)
- The result toolchain version (`rustc --version`)
- Description of the expected vs actual behaviour

I'll acknowledge the report within 72 hours and aim to ship a fix within 7 days for confirmed issues.

### Discloruse Policy

Once a bug is published, the vulnerability will be disclosed publicly via the GitHub Security Advisory. There is no embargo period for this crate given its scope. If a fix is available, users should know immediately.
