Please report vulnerabilities privately through GitHub: Report a vulnerability (Security → Advisories → Report a vulnerability). Don't open a public issue for a security problem.

Include what you can of: the affected version, the configuration or code involved, a request or input that reproduces it, and the impact you expect. You should get a first response within a few days. Fixes ship in a new release with the advisory published alongside it, crediting you unless you'd rather stay anonymous.

Security fixes go into the latest release only. rws releases are additive within a major version, so upgrading to the newest 17.x is the supported path.

• cargo audit and npm audit on every push and weekly.
• Fuzzing of every parser that sees untrusted input — HTTP requests and responses, Range headers, JSON, MCP JSON-RPC, forms, URLs, JWTs, SAML XML, and the config files — on every push and weekly. See fuzz/README.md.
• End-to-end checks against Let's Encrypt's test CA (Pebble) and HTTP/2 conformance with h2spec on every push (ci/e2e/).