LoxDust treats stored bytes as hostile input.
The core invariants are:
- corrupt or mixed payloads must not be returned as verified data
- layout and metadata must be validated before use
- region bounds and object bounds must be checked before storage access
Report security-sensitive issues through the repository's private security channel if one exists in the hosting platform.
If no private channel is configured, use the least public option available and avoid posting exploit details in an open issue until triage is complete.
- affected version or commit
- exact environment
- reproduction steps
- expected behavior
- observed behavior
- whether persistent data may be corrupted or exposed
Do not attempt to bypass validation, damage test fixtures, or use production data while investigating.