Please do not report security vulnerabilities through public GitHub issues.

Report it privately through GitHub Security Advisories or email yuriyzee@gmail.com with:

• a description of the issue and its impact,
• a minimal reproduction if possible,
• the package and PHP versions affected.

You'll get an acknowledgement within 48 hours and a status update within 7 days. Once a fix is released, we'll coordinate disclosure with you and credit you in the release notes (unless you prefer to stay anonymous).

Every release carries a source archive, a CycloneDX SBOM and a signed build provenance attestation:

gh attestation verify simple-data-objects-vX.Y.Z.tar.gz --repo std-out/simple-data-objects

Two parts of the codebase carry explicit security invariants:

• EncryptedCast — XSalsa20-Poly1305 via libsodium (nonce handling, key derivation, ciphertext format).
• Metadata cache (.meta.php files) — executable PHP loaded from the cache directory; writes are atomic and guarded by an exportability check.

Reports touching these areas are prioritized.