Do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities privately by emailing matt@jellybaby.com with the subject line [go-DDS SECURITY] <short description>.

Include:

• A description of the vulnerability and its potential impact
• Steps to reproduce (proof of concept if available)
• Affected versions / configurations
• Any suggested mitigations

We will acknowledge receipt within 2 business days and aim to provide a fix or mitigation within 14 calendar days for critical issues, or 90 days for lower severity findings.

go-DDS targets deployment in safety-critical environments (automotive ASIL-B, aerospace DO-178C). The security posture reflects these requirements:

• Authentication: HMAC-SHA-256 and AES-256-GCM plugins for message authentication and encryption (see security/ package).
• Transport isolation: Shared-memory transport is process-local; RTPS/UDP is constrained to declared multicast groups.
• No remote code execution surface: No dynamic plugin loading; all transports are compiled in.
• Dependency minimisation: The core dds, rtps, shmem, and mock packages have zero non-standard-library dependencies.

We follow coordinated disclosure: vulnerabilities are kept confidential until a fix is available and all known affected users have had a reasonable opportunity to upgrade. We credit researchers in the release notes unless they prefer to remain anonymous.

This project targets Security Level SL-2 under IEC 62443-4-2. The threat model, countermeasures, and residual risks are documented in tara.json (generated by gofusa tara) and the .fusa-iec62443.json configuration.

See also INCIDENT-RESPONSE.md for the incident management procedure.