tters / tte-expand is pre-1.0; fixes land on the latest released version. Please test against the newest r-universe build or main before reporting.

Please report suspected vulnerabilities privately — do not open a public issue for a security report.

• Preferred: GitHub private vulnerability reporting (repository Security → Report a vulnerability).
• Alternatively: email oldschoolcool@gmail.com with details and, if possible, a minimal reproduction.

Expect an acknowledgement within a few days. Once a fix is available we will coordinate disclosure and credit reporters who wish to be named.

This project is a deterministic, offline data-transformation library, not a networked service: it reads local Parquet / data.frame inputs and produces expanded outputs. The realistic risk surface is therefore the software supply chain rather than runtime exploitation:

• Dependencies are gated by cargo deny (advisories, licenses, bans, sources), and Cargo.lock is committed for reproducible builds.
• Secrets are kept out of the tree by gitleaks (pre-commit + CI) and a block-secrets guard.
• The engine crate is #![forbid(unsafe_code)].

Memory-safety, determinism, and supply-chain issues are all in scope — if you find one, we want to know.