# Security Policy

## Reporting a Vulnerability

If you have any security concern, contact <matz@ruby.or.jp>.

## Scope

We consider the following issues as vulnerabilities:

* Remote code execution
* Crash caused by a valid Ruby script

We *don't* consider the following issues as vulnerabilities:

* Runtime C undefined behavior (including integer overflow)
* Crash caused by misused API
* Crash caused by modified compiled binary
* ASAN/Valgrind warning for too big memory allocation
  mruby assumes `malloc(3)` returns `NULL` for too big allocations