If you discover a security vulnerability in the KeelMatrix.MetricBudget package, report it privately by either:
- emailing keelmatrix@gmail.com
- opening a private GitHub security advisory
Do not create a public issue for security vulnerabilities.
Useful report details:
- affected package version
- target framework and runtime
- reproduction steps or proof of concept
- impact, and any suggested mitigation if known
Reports are handled best-effort. Valid issues will be investigated and fixed as appropriate for the current maintained release line.
The package observes System.Diagnostics.Metrics measurements from code running in the same process. It does not
read metric values, and its bounded accounting state retains only fixed-size digests rather than raw tag values.
Transient managed strings and byte buffers can briefly contain tag-derived data while a callback builds and hashes
an identity; reusable hash scratch is cleared after each digest, but ordinary process memory is not a secure-erasure
boundary. It opens no network connections except the anonymous telemetry signal described in
PRIVACY.md. Reports and assertion messages never contain tag values, metric values, or workload
samples, but they retain application-supplied meter names, meter versions, instrument names, and tag keys. Review
those identifiers before sharing diagnostics outside their intended audience.
Security fixes are prioritized for the latest released package line. Older versions may receive fixes on a case-by-case basis.
- Do not post details of the security issue in public repositories or issue trackers.
- Include as much information as possible to help us reproduce and resolve the issue.
- We may request additional information or a proof of concept to verify and fix the vulnerability.