Only the latest tagged release on master is supported. There are no long-term branches.

Mail z3r0.dayz0101@gmail.com with:

• a subject line starting with [fastalloc security]
• a description of the vulnerability
• a minimal reproducer, ideally one .cpp file plus build instructions
• what you expected vs. what happened

Please do not file a public GitHub issue for unpatched security bugs. I'll acknowledge within 7 days and aim to land a fix within 30 days of acknowledgement, or negotiate a coordinated disclosure window if the fix is structural.

In scope:

• memory-safety bugs (out-of-bounds, use-after-free, double-free) in any header under src/
• freelist corruption reachable from documented public API
• concurrency bugs (data races, ABA) in cross_thread.hpp
• sanitizer failures (ASan / TSan / UBSan) on the smoke test

Out of scope:

• CPU-level side channels (Spectre, Rowhammer, etc.)
• hardening against attacker-controlled input (this is a same-trust-domain allocator; it does not defend against malicious callers in the same process)
• denial-of-service via deliberate overcommit or pathological bucket exhaustion