PolyAudio is pre-1.0; security fixes land on the latest 0.x release only.

Please report suspected vulnerabilities privately via GitHub's security advisories rather than a public issue.

Include a description, reproduction steps, and the affected version. I aim to acknowledge reports within a few days and to ship a fix or mitigation before any public disclosure.

PolyAudio parses user-provided manifests (JSON/CSV) and TOML suite files. It does not execute code from those files and does not decode audio itself. The most likely issue class is a malformed-input crash rather than remote code execution — those are still worth reporting.