Report vulnerabilities privately through GitHub Security Advisories. Do not open a public issue, pull request, or discussion.

Include:

• affected version or commit
• configuration needed to reproduce
• steps or a proof of concept
• impact you observed

We acknowledge reports within 3 business days and keep you updated until a fix ships. Once a fix is released, we publish an advisory and credit you unless you ask us not to.

Only the latest release receives security fixes. Upgrade to the newest release before reporting.

Release binaries carry GitHub build provenance attestations:

gh attestation verify erpc_linux_x86_64 --repo erpc/erpc