The latest 0.1.x release receives security fixes.

Use the repository's private GitHub security advisory form. Do not open a public issue with a working exploit or a private asset.

Include the affected version, operating system, minimal untrusted input, observed impact, and reproduction command. You should receive an acknowledgement within seven days. A fix and disclosure timeline will be coordinated in the private advisory.

HapLint parses untrusted local files but never executes their contents or contacts the network. The parser caps each file at 5 MiB, rejects duplicate JSON keys, confines explicitly checked waveform paths to the selected bundle root, and escapes SVG text. See docs/threat-model.md for residual risks.