Report it privately through GitHub. Go to the Security tab of https://github.com/keivanmalhani/timecode and choose Report a vulnerability to open a private advisory. That goes to the maintainer and stays private until there is a fix.

Please do not open a public issue for a vulnerability.

Include what you did, what happened, and what you expected. Whatever reproduces it, an input file, a command line, a link, helps more than a description of it.

This is arithmetic. The realistic surface is small and it is worth saying what it actually is:

• a crafted timecode or frame rate string that causes a panic, an unbounded loop, or unbounded allocation rather than an error return
• an integer overflow that produces a wrong answer instead of an error, which in a conform or an EDL is a silent corruption rather than a crash
• anything in the release pipeline that could put code the maintainer did not write into a published module version

Out of scope: disagreements about what SMPTE ST 12-1 requires, which are bugs and belong in a normal issue with the clause quoted; and output from an automated scanner with no working proof.

A Go library and a small command line tool. It parses timecode strings, does arithmetic on them, and prints the result. It reads stdin and writes stdout.

It opens no files, makes no network request, spawns no process, and has no dependency outside the standard library. There is no credential involved anywhere and nothing for it to leak.

The most recent tagged release is the supported version. There is no deployment: the tool runs on your machine from a checkout or an install. Older tags do not get backported fixes.