luau-rs is experimental and does not currently have a production-supported release. Security and memory-safety reports are still taken seriously.

Do not open a public issue, discussion, or pull request for a suspected vulnerability. Use GitHub's private vulnerability-reporting flow from the repository's Security page.

If the private reporting button is unavailable, open a public issue containing no technical details and ask the maintainers to establish a private reporting channel. Wait for that channel before sharing a reproducer or affected code.

Include, when available:

• the affected version or commit;
• the affected crate and public API path;
• operating system, architecture, Rust version, and sanitizer output;
• a minimal, defensive reproducer;
• the expected impact and any known preconditions.

Please do not include weaponized payloads, exploitation instructions, or data from systems you do not own. Reports should be limited to demonstrating and correcting the issue in this library.

The maintainers will determine whether the defect is in luau-rs or in behavior owned by Luau upstream and coordinate disclosure or a source-faithful fix as appropriate. No response-time or embargo SLA is currently offered.