| Version | Supported |
|---|---|
| 0.x.x | Yes (development) |
Once we reach v1.0, we will maintain security updates for the current major version and one previous major version.
The toolchain files in this repository are CMake configuration scripts. They:
- Set the location of the host's ARM cross-compiler (
arm-none-eabi-gcc,clang, etc.) and ancillary tools (ar,nm,objcopy, …). - Detect the compiler's sysroot via
execute_process(COMMAND ${CMAKE_C_COMPILER} -print-sysroot). - Configure CMake's root-path search behaviour (
CMAKE_FIND_ROOT_PATH_MODE_*).
A vulnerability in this context typically means one of:
- The toolchain file causes CMake to invoke an unintended program (e.g. by accepting an attacker-controlled path that resolves to a malicious binary).
- The toolchain file leaks information from the host environment that should remain private.
- The toolchain file produces silently miscompiled output for a specific compiler version, in a way that is consequential to safety-critical or secure embedded systems.
If you believe you've found something matching one of those, please report it privately as described below.
Please do NOT report security vulnerabilities through public GitHub issues.
-
Preferred: use GitHub Security Advisories to report the vulnerability privately.
-
Alternative: email the maintainer directly at matejg03@gmail.com.
When reporting, please include:
- A clear description of the vulnerability and the conditions that trigger it.
- Steps to reproduce — including the exact toolchain version, CMake version, host OS, and any environment variables involved.
- Potential impact assessment.
- Any suggested fix or mitigation (optional but appreciated).
| Action | Timeframe |
|---|---|
| Initial acknowledgement | Within 48 hours |
| Preliminary assessment | Within 1 week |
| Fix development | Depends on severity and complexity |
| Security advisory publication | After fix is available |
-
Acknowledgement. We will acknowledge receipt of your report within 48 hours.
-
Communication. We will keep you informed of our progress and may ask for additional information.
-
Credit. Unless you prefer to remain anonymous, we will credit you in the security advisory and release notes.
-
Disclosure. We follow responsible disclosure practices. We ask that you give us reasonable time to address the issue before any public disclosure.
This security policy was last updated on 2026-04-25.