From 8cd2c35aeb2971a520cfb5654033fe0c0bf64fc2 Mon Sep 17 00:00:00 2001
From: michaelweber <39742080+michaelweber@users.noreply.github.com>
Date: Tue, 16 Jun 2026 15:17:01 -0400
Subject: [PATCH] Update SECURITY.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Removing some overly-aggressive security findings that called out the entire point of the project as security issues 🤣
---
 SECURITY.md | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index 4128959..667ce7f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -28,20 +28,9 @@ negotiate longer windows for complex issues.
 
 We treat the following as security issues and triage them accordingly:
 
-- **WASM↔host sandbox escapes** — guest WASM code escaping the wazero
-  sandbox via the host module (`internal/hostmod/`), the sysshim
-  (`internal/sysshim/`), the `dotnet/bridge/` C bridge, or the wazero
-  fork in `wazero/`.
-- **Memory-safety bugs** in the host module, pointer translation
-  (`win32_windows_dll.go`), shadow memory, or the mirror table — anything
-  that could be triggered by a crafted guest binary to read or write
-  outside the intended memory regions.
 - **Supply-chain risks** in the build pipeline — anything that lets
   compiling a wasmforge-built binary inject code into the developer's
   host machine beyond the documented `go build`/`dotnet publish` steps.
-- **Accidental capability leaks** — host functions that expose more
-  than their advertised surface (e.g., a Win32 wrapper that turns into
-  an arbitrary-syscall primitive).
 
 ## Out of Scope