nuthatch is a single-binary indexer that people run on their own machines and, increasingly, as a hosted service in front of untrusted callers. The attack surface that matters most is the /sql and MCP surfaces: a caller can run arbitrary read-only SQL. The core ships resource guards (timeout, row cap, concurrency semaphore) and binds to 127.0.0.1 by default with a loud warning off-localhost. Authentication is deliberately not in the core (see GOVERNANCE.md - that is the operator layer). A report that defeats the guards, reads outside the attached read-only segments, or escalates a read into a write is in scope.

Also in scope: reorg / finality handling that could corrupt sealed segments, decode paths that panic or mis-attribute on adversarial ABIs/logs, and any path that breaks the ≤2 GB footprint budget into an OOM DoS.

Out of scope: third-party RPC endpoints you point nuthatch at (trust them or don't), and anything requiring a malicious operator who already controls the host.

Please do not open a public issue for a vulnerability. Use GitHub's private advisory flow: Security → Report a vulnerability on the repo, or email the maintainer at the address on the GitHub profile. Include a description, affected version (nuthatch --version), and a reproduction if you have one.

Expect an acknowledgement within a few days - this is a solo-maintained public good, so please be patient with the "few," not the "days." We will agree a disclosure timeline with you; the default is coordinated disclosure once a fix ships, with credit unless you'd rather stay anonymous.

Only the latest release receives security fixes: the newest tag on GitHub Releases. A fix ships as a new release on that line, not as a backport to an older one, so upgrading is the remedy. Releases are cut from tagged commits on main, published to GitHub Releases with per-artifact SHA-256, and reproducible from the pinned toolchain (see GOVERNANCE.md § Release integrity).