Found a way past the cage? Report it privately via GitHub — the repository's Security tab → Report a vulnerability (this drafts a private advisory). Email security@hexproof.dev works too. Please include a description, a reproducer or proof-of-concept, and the affected version or commit.

You can expect acknowledgment within a few days, a fix for valid issues, and credit if you'd like it. Please give us time to patch before disclosing publicly.

A bypass of the cage — escaping the Landlock or seccomp confinement oring applies to itself — is a vulnerability. A documented residual is not: the pathname-socket reach without --features resolve-unix, UDP/DNS egress, peer /proc/<pid> reads (environ/maps under --proc full — use --proc self or a runtime PID-ns), "not a VM boundary", and the workdir-poisoning class are all by design and enumerated in the threat model — see docs/DESIGN.md §2. Those are the model working as intended, not defects.