Email the maintainer at rgoswami@ieee.org with a description, a reproducer, the affected version or tag, and the expected impact. Do not open a public issue for security matters.
There is no bug bounty.
Security fixes land on main and ship in the next vX.Y.Z tag. Older
lines receive best-effort attention; upgrade to the latest tag.
In scope: ingest and export of untrusted CON/convel, the C ABI (rkrdb_*),
language bindings, LMDB corpus files, and release artifacts published from
this repository.
Out of scope: readcon-core defects that are not db-specific, and third-party LMDB/Heed issues without a readcon-db-specific defect.