From 3ea71ded4e271b497fcbe5dab3a1d4e656db7054 Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Fri, 4 Sep 2026 23:00:20 +0100 Subject: [PATCH 1/5] Add an initial security policy --- fearless_simd/SECURITY.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 fearless_simd/SECURITY.md diff --git a/fearless_simd/SECURITY.md b/fearless_simd/SECURITY.md new file mode 100644 index 00000000..9a240185 --- /dev/null +++ b/fearless_simd/SECURITY.md @@ -0,0 +1,18 @@ +# Security Policy + +## Supported Versions + +Starting with v1.0, we will provide security backports for the latest version of Fearless SIMD for each MSRV (minimum supported Rust version) for *at least* 3 years since its MSRV was released. + +This ensures that security updates are just a `cargo update` away, no matter what Rust compiler version you use (as long as it's not older than 3 years). + +As an example: if (hypothetically) both 1.0.x and 1.1.x have an MSRV of 1.89, while 1.2.x has MSRV of 1.100, both 1.1.x and 1.2.x will receive security backports, while 1.0.x will not because a patched version with the same MSRV is already available. If v2.0 is released, v1.x.x will continue receiving security backports for *at least* 3 years since the release date of its MSRV. + +Earlier versions may or may not receive security backports at the discretion of Fearless SIMD maintainers. + +## Reporting a Vulnerability + +This repository follows a full disclosure policy. Please report security issues on the Github issue tracker. + +Entirely AI-generated reports are not permitted. While the use of LLMs for auditing code is welcome, +the issue must be understood and verified by a human before reporting. \ No newline at end of file From 5feca4863f0aada2bca6f21c2cce8a5b5f80f0fe Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Fri, 4 Sep 2026 23:16:55 +0100 Subject: [PATCH 2/5] Link to the security policy from the README, add post-v1.0 policy on MSRV and version bumps --- fearless_simd/README.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fearless_simd/README.md b/fearless_simd/README.md index f07d3038..4adfb04f 100644 --- a/fearless_simd/README.md +++ b/fearless_simd/README.md @@ -233,8 +233,11 @@ It benefited from conversations with Luca Versari, though he is not responsible This version of Fearless SIMD has been verified to compile with **Rust 1.89** and later. -Future versions of Fearless SIMD might increase the Rust version requirement. -It will not be treated as a breaking change and as such can even happen with small patch releases. +Future versions of Fearless SIMD might increase the Rust version requirement. This will be accompanied by a minor version bump. + +MSRV increases do not impact existing users: +Cargo supports [an MSRV-aware resolver](https://doc.rust-lang.org/edition-guide/rust-2024/cargo-resolver.html) and will not select a version that fails to build, +and we provide [security backports](SECURITY.md) to older Rust versions released within the last 3 years. ## Community From 7ad56cc5d242189fce743064703eb303d27ad8eb Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Fri, 4 Sep 2026 23:19:26 +0100 Subject: [PATCH 3/5] Clarify security policy --- fearless_simd/SECURITY.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fearless_simd/SECURITY.md b/fearless_simd/SECURITY.md index 9a240185..06172a6e 100644 --- a/fearless_simd/SECURITY.md +++ b/fearless_simd/SECURITY.md @@ -6,13 +6,15 @@ Starting with v1.0, we will provide security backports for the latest version of This ensures that security updates are just a `cargo update` away, no matter what Rust compiler version you use (as long as it's not older than 3 years). -As an example: if (hypothetically) both 1.0.x and 1.1.x have an MSRV of 1.89, while 1.2.x has MSRV of 1.100, both 1.1.x and 1.2.x will receive security backports, while 1.0.x will not because a patched version with the same MSRV is already available. If v2.0 is released, v1.x.x will continue receiving security backports for *at least* 3 years since the release date of its MSRV. +As an example: if (hypothetically) both 1.0.x and 1.1.x have an MSRV of 1.89, while 1.2.x has MSRV of 1.100, both 1.1.x and 1.2.x will receive security backports, while 1.0.x will not because a fixed version with the same MSRV is already available and will be fetched by `cargo update`. If v2.0.0 is released, versions in v1.x.x series will continue receiving security backports as per the above policy. Earlier versions may or may not receive security backports at the discretion of Fearless SIMD maintainers. +You can look up when each Rust version was released in the [Rust Release Notes](https://doc.rust-lang.org/stable/releases.html). + ## Reporting a Vulnerability -This repository follows a full disclosure policy. Please report security issues on the Github issue tracker. +This repository follows a full disclosure policy. Please report security issues publicly on the Github issue tracker. Entirely AI-generated reports are not permitted. While the use of LLMs for auditing code is welcome, -the issue must be understood and verified by a human before reporting. \ No newline at end of file +the issue must be reproduced and understood by a human before reporting. \ No newline at end of file From 5d17db52a3e628f867f9f9b85e496aea21d510db Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Sat, 5 Sep 2026 01:09:39 +0100 Subject: [PATCH 4/5] apply review suggestion on wording Co-authored-by: Daniel McNab <36049421+DJMcNab@users.noreply.github.com> --- fearless_simd/README.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fearless_simd/README.md b/fearless_simd/README.md index 4adfb04f..cda19550 100644 --- a/fearless_simd/README.md +++ b/fearless_simd/README.md @@ -235,9 +235,8 @@ This version of Fearless SIMD has been verified to compile with **Rust 1.89** an Future versions of Fearless SIMD might increase the Rust version requirement. This will be accompanied by a minor version bump. -MSRV increases do not impact existing users: -Cargo supports [an MSRV-aware resolver](https://doc.rust-lang.org/edition-guide/rust-2024/cargo-resolver.html) and will not select a version that fails to build, -and we provide [security backports](SECURITY.md) to older Rust versions released within the last 3 years. +If you require a fixed MSRV, we recommend using Cargo's [MSRV-aware resolver](https://doc.rust-lang.org/edition-guide/rust-2024/cargo-resolver.html) which will not select a version that fails to build. +We will provide [security backports](SECURITY.md) to older Rust versions released within the last 3 years. ## Community From 8d27cda2cfe46857b99415d6b026586cd84477f6 Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Sat, 5 Sep 2026 01:22:06 +0100 Subject: [PATCH 5/5] Add a trailing newline --- fearless_simd/SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fearless_simd/SECURITY.md b/fearless_simd/SECURITY.md index 06172a6e..0ac20e81 100644 --- a/fearless_simd/SECURITY.md +++ b/fearless_simd/SECURITY.md @@ -17,4 +17,4 @@ You can look up when each Rust version was released in the [Rust Release Notes]( This repository follows a full disclosure policy. Please report security issues publicly on the Github issue tracker. Entirely AI-generated reports are not permitted. While the use of LLMs for auditing code is welcome, -the issue must be reproduced and understood by a human before reporting. \ No newline at end of file +the issue must be reproduced and understood by a human before reporting.