The CKS Runtime reference implementation is actively maintained. Security fixes are provided for the current stable release and the immediately preceding minor version.
| Version | Supported |
|---|---|
| 1.20.x | ✅ |
| 1.19.x | ✅ |
| < 1.19 | ❌ |
If you discover a security vulnerability in CKS Runtime, please report it responsibly.
Please avoid creating a public GitHub issue for vulnerabilities that could affect users before they are investigated.
Instead, contact the project maintainer directly through GitHub.
When reporting a vulnerability, please include:
- a description of the issue;
- affected version;
- reproduction steps;
- expected behavior;
- actual behavior;
- any proof-of-concept if available.
The project aims to:
- acknowledge reports promptly;
- investigate the reported issue;
- determine severity and impact;
- prepare an appropriate fix;
- publish the fix in a future release;
- acknowledge the reporter when appropriate.
At the current stage of development, the primary Runtime security considerations are:
- Session lifecycle isolation;
- Transaction integrity;
- Version immutability;
- Storage safety;
- Runtime state recovery;
- adapter boundary isolation;
- deterministic Runtime behaviour.
CKS Runtime does not define knowledge semantics.
Semantic validation remains the responsibility of CKS Core.
Please allow reasonable time for investigation and remediation before publicly disclosing security vulnerabilities.
Responsible disclosure helps protect users while fixes are prepared.
CKS Runtime follows several architectural principles that naturally support secure implementations:
- immutable Runtime Versions;
- deterministic Runtime execution;
- explicit Transaction boundaries;
- isolated Runtime Sessions;
- storage abstraction;
- transport independence;
- strict separation between operational and semantic responsibilities.
CKS Runtime intentionally delegates all semantic validation to CKS Core and never reinterprets canonical knowledge.
These principles reduce implementation risk and preserve predictable Runtime behaviour, while not eliminating the need for ongoing security review.