Lentil is pre-release. Only the current main development line receives security fixes; no released version currently carries a stable support commitment.

Please do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting flow from this repository's Security tab. If that flow is unavailable, contact the repository maintainers privately through the pb64-lean organization before disclosing details publicly.

Include, when possible:

• the affected revision and build or runtime environment;
• a minimal reproduction or proof of concept;
• the expected and observed trust-boundary behavior;
• potential impact; and
• any known mitigation.

The maintainers do not currently promise a response SLA. They will coordinate validation, remediation, and disclosure through the private report.

Lentil's attributes and commands run metaprogramming code during Lean elaboration, so imported Lean modules and build inputs are trusted. Generated declarations are checked by Lean, but that does not establish that a bean factory's computation is safe or that its IO effects have the intended behavior. Compile-time dependency selection and cycle checks likewise do not sandbox factories or prove application-specific security properties.

Environment variables consumed by Config.Config and @[lentil_config] are untrusted runtime input. Applications are responsible for validating values whose domain constraints go beyond their EnvValue parser and for protecting the resulting configuration in logs and memory. Built-in parse errors omit raw values, but custom EnvValue instances control their own diagnostic text. Custom parsers for secrets should not include the input value in an error.