Security

.github/SECURITY.md

Security Policy

Supported Versions

Only the latest release receives security updates.

Version	Supported
Latest	Yes
Older	No

Reporting a Vulnerability

Please report security vulnerabilities through GitHub's private vulnerability reporting.

Do not open a public issue for security vulnerabilities.

Scope

In scope:

Extension source code (client, server, syntaxes)
Dependency vulnerabilities
Malicious input via NMTRAN files (e.g., path traversal, code execution)

Out of scope:

NONMEM software itself
VS Code / Positron core
Third-party extensions

Response

Acknowledgement within 7 days
Fix or mitigation within 30 days for confirmed vulnerabilities

There aren't any published security advisories