Plotlars is maintained by Alberto Cebada Aleu (@alceal), who is also its security contact. Security reports go to the maintainer directly and are handled privately until a fix is released.

Only the latest release line receives security fixes.

The fix ships in a new patch release of all the workspace crates (plotlars, plotlars-core, plotlars-plotly, plotlars-plotters).

Please do not report security issues in public GitHub issues, discussions or pull requests.

Report them privately in one of these ways:

1. GitHub private vulnerability reporting (preferred): open the Security tab and choose "Report a vulnerability".
2. Email: contact@albertocebada.com, with "plotlars security" in the subject.

Please include:

• the affected crate(s) and version(s)
• a description of the issue and its impact
• steps or a minimal code example to reproduce it
• any suggested fix, if you have one

• Acknowledgement of your report within 7 days.
• An initial assessment (confirmed, needs more information, or not a vulnerability) within 14 days.
• For confirmed issues, a fix and a patch release as soon as practical, with a target of 90 days from the report. You are kept informed along the way.
• Once a fix is available, a GitHub Security Advisory is published, a CVE is requested when appropriate, and the issue is reported to the RustSec Advisory Database. Reporters are credited in the advisory unless they prefer to stay anonymous.

Please give the maintainer a reasonable chance to release a fix before disclosing the issue publicly.

In scope: vulnerabilities in the plotlars crates themselves, for example:

• unescaped data from a DataFrame (titles, labels, hover text, category names) that can inject script into HTML generated by the Plotly backend
• unsafe file handling when saving plots to disk
• panics or unbounded resource use that untrusted input can trigger

Out of scope:

• vulnerabilities in upstream dependencies such as Polars, plotly.rs or Plotters. Please report those to their projects. If plotlars exposes or worsens such an issue, report it here as well.
• issues that require the attacker to already control the application code that calls plotlars