Project SPANDAN is a deterministic C++ DSP audio engine and polyphonic software synthesizer built with JUCE. Because SPANDAN compiles into native binary plugins (VST3, AU, and Standalone) that execute low-level code directly inside digital audio workstations (DAWs) and operating system audio drivers, maintaining memory safety, audio thread stability, and security is paramount.

We actively monitor and provide security patches for the following versions of SPANDAN:

We take all security and memory-safety vulnerabilities seriously. If you discover a security flaw, potential buffer exploit, or severe memory bug in SPANDAN, please do not open a public GitHub issue.

1. GitHub Private Security Advisory (Preferred): Navigate to the Security tab of the cryparc/Spandan repository, select Advisories, and click "Report a vulnerability".

2. Direct Email Disclosure: If private GitHub advisories are unavailable, send an encrypted email with the details to the core maintainers: [149800456+cryparc@users.noreply.github.com]

To help us triage and resolve the issue quickly, please include:

• Type of Vulnerability: (e.g., Buffer Overflow, Integer Overflow, Stack Corruption, Memory Leak, Denial-of-Service via Audio Thread Lock).
• Environment: Operating System (macOS, Windows, Linux), Compiler version (MSVC, Clang, GCC), and DAW host used during testing.
• Reproduction Steps: Minimal code snippet, crafted MIDI sequence, or step-by-step instructions to trigger the vulnerability.
• Proof of Concept (PoC): AddressSanitizer (ASan) or UndefinedBehaviorSanitizer (UBSan) logs if available.

We follow a responsible disclosure process:

• Initial Acknowledgment: Within 48 hours of receiving your report.
• Triage & Impact Assessment: Within 5 business days, confirming whether the report is reproducible.
• Patch Release & Security Advisory: We aim to release a fix within 30 days of confirmation.
• Public Disclosure: Once a security patch is merged into main and a release tag is cut, we will publish a CVE/GHSA advisory giving full credit to the discoverer (unless anonymity is requested).

To ensure SPANDAN remains resilient against exploits and real-time execution hazards, our codebase adheres to strict safety principles:

• Zero Raw Pointer Ownership: All dynamic objects use modern C++ smart pointers (std::unique_ptr, std::shared_ptr) or stack allocation.
• Array Bounds Checking: All buffer access routines in audio processing loops must enforce strict index clamping (std::clamp) or assertion checks to prevent out-of-bounds reads/writes.

• No Unbounded Memory Allocations: No new or malloc calls inside processBlock() to prevent heap exhaustion or heap manipulation exploits.
• No Locking / Mutex Primitives: Thread synchronization utilizes lock-free atomic operations (std::atomic) to prevent thread-starvation attacks or deadlocks on the high-priority real-time thread.

All pull requests must pass our CI pipeline with zero warnings across:

• AddressSanitizer (ASan): Detects out-of-bounds accesses and use-after-free bugs.
• UndefinedBehaviorSanitizer (UBSan): Catches integer overflows, shift out-of-bounds, and null pointer dereferences.
• ThreadSanitizer (TSan): Verifies data-race freedom across the UI and Audio threads.

We deeply appreciate the efforts of security researchers and open-source contributors who help make SPANDAN safer. Confirmed security reporters will be publicly acknowledged in our SECURITY_HALL_OF_FAME.md and release notes.