Skip to content

Security: whuppi/fluent_icu

Security

SECURITY.md

Security Policy

Reporting a vulnerability

Report privately via GitHub Security Advisories. Do not open a public issue.

What's in scope

  • Value misrepresentation — a formatter output that misrepresents the input (a currency amount rendering as a different quantity, a sign flip, digits dropped beyond documented rounding) is a security report: apps put these strings in front of users making decisions.

  • The degrade contract failing silently — an unsupported option must render the nearest supported form AND record a FluentTypeError. A path that drops an option without the recorded error defeats the auditability the contract exists for.

What's NOT in scope

  • The ICU4X engine itself — memory-safety or data issues inside icu_kit / ICU4X belong to icu_kit's policy and upstream.

  • Untrusted-FTL handling — parsing and resolution guards are fluent_bundle's scope; this package only formats values.

  • CLDR correctness disputes — the data is Unicode's; fidelity bugs are regular issues.

Response

Valid reports are fixed and shipped as patch versions.

There aren't any published security advisories