Do not open a public GitHub issue for security vulnerabilities.

Please report security issues privately via:

• GitHub Security Advisories: Report a vulnerability
• Email: security@mappers.dev (PGP key available on request)

• Description of the vulnerability
• Steps to reproduce
• Affected versions
• Potential impact assessment
• Suggested fix (if any)

Mappers processes untrusted data (API payloads, user input). Key considerations:

• Type coercion — ScalarCaster performs type coercion. Values outside expected ranges throw CastingException, never silently truncate.
• JSON decoding — JsonMappingException is thrown on malformed JSON; the library never swallows parse errors.
• Reflection access — Mappers uses ReflectionProperty::setAccessible(true) to write private/protected properties. This is intentional and documented. Do not map untrusted classes with destructive side effects in setters.
• Class instantiation — ArrayToObjectMapper instantiates classes by name. Never pass user-controlled class names as the $target parameter.
• Circular references — Protected by MappingContext reference tracking. The #[MaxDepth] attribute limits recursion depth.

• Does not execute arbitrary code from mapped data
• Does not call eval() or dynamic code generation
• Does not make network requests
• Does not access the filesystem
• Does not log sensitive data

// SAFE: class name is hardcoded
$dto = $mappers->map($request->all(), UserDto::class);

// UNSAFE: never pass user-controlled class names
$class = $request->get('target_class'); // attacker-controlled
$dto = $mappers->map($data, $class);    // DO NOT DO THIS

// Use groups to prevent over-exposure of sensitive fields
$context = $mappers->context(['public']);
$array   = $mappers->toArray($user, $context); // password excluded