restructured the security policy to reduce misunderstandings:
- high priority: remote code execution (RCE) vulnerabilities only
- lower priority: VM crashes from valid Ruby code (accepted but preferably
reported as bugs on issue tracker)
- out of scope: resource exhaustion, malformed bytecode, C API misuse,
theoretical undefined behavior, allocation warnings
added detailed rationale and examples for each category, explaining mruby's
role as an embeddable interpreter and the host application's responsibility
for sandboxing and resource management.
Co-authored-by: Claude <noreply@anthropic.com>
mruby expects `malloc(3)` returns `NULL` for too big allocations, so
even if big object allocation (e.g. `[1,2,3]*268888888888888818`)
caused ASAN/Valgrind warnings, it's intentional, and we won't consider
the warning as a security issue.
Yukihiro "Matz" Matsumoto