luau/SECURITY.md

# Security Guarantees

Luau provides a safe sandbox that scripts can not escape from, short of vulnerabilities in custom C functions exposed by the host. This includes the virtual machine, builtin libraries and native code generation facilities.

Any source code can not result in memory safety errors or crashes during its compilation or execution. Violations of memory safety are considered vulnerabilities.

Note that Luau does not provide termination guarantees - some code may exhaust CPU or RAM resources on the system during compilation or execution.

The runtime expects valid bytecode as an input. Feeding bytecode that was not produced by Luau compiler into the VM is not supported, and
doesn't come with any security guarantees; make sure to sign and/or encrypt the bytecode when it crosses a network or file system boundary to avoid tampering.

# Reporting a Vulnerability

You can report security bugs via [HackerOne](https://hackerone.com/roblox). Please refer to the linked page for rules of the bounty program.
Create SECURITY.md Fixes #197. 2021-11-15 12:04:26 -08:00			`# Security Guarantees`

Update native code generation note in the security guarantees (#1250) 2024-05-08 13:35:12 -07:00			`Luau provides a safe sandbox that scripts can not escape from, short of vulnerabilities in custom C functions exposed by the host. This includes the virtual machine, builtin libraries and native code generation facilities.`
Create SECURITY.md Fixes #197. 2021-11-15 12:04:26 -08:00
			`Any source code can not result in memory safety errors or crashes during its compilation or execution. Violations of memory safety are considered vulnerabilities.`

			`Note that Luau does not provide termination guarantees - some code may exhaust CPU or RAM resources on the system during compilation or execution.`

Revise some of the copytext in markdown files. (#1677) We have a bunch of small grammatical nits and slightly awkward phrasings present in our existing markdown files. This is a small pass over all of them to fix those, and to provide some additional updated information that has become more clear over time (like additional users of Luau, or our leveraging something akin to the Minus 100 Points philosophy for evaluating RFCs). --------- Co-authored-by: Varun Saini <61795485+vrn-sn@users.noreply.github.com> 2025-02-20 15:56:00 -06:00			`The runtime expects valid bytecode as an input. Feeding bytecode that was not produced by Luau compiler into the VM is not supported, and`
Update SECURITY.md (#209) In some use cases it is better to encrypt the bytecode, while on others you may want to do both. 2021-11-17 16:42:14 +02:00			`doesn't come with any security guarantees; make sure to sign and/or encrypt the bytecode when it crosses a network or file system boundary to avoid tampering.`
Create SECURITY.md Fixes #197. 2021-11-15 12:04:26 -08:00
			`# Reporting a Vulnerability`

Revise some of the copytext in markdown files. (#1677) We have a bunch of small grammatical nits and slightly awkward phrasings present in our existing markdown files. This is a small pass over all of them to fix those, and to provide some additional updated information that has become more clear over time (like additional users of Luau, or our leveraging something akin to the Minus 100 Points philosophy for evaluating RFCs). --------- Co-authored-by: Varun Saini <61795485+vrn-sn@users.noreply.github.com> 2025-02-20 15:56:00 -06:00			`You can report security bugs via [HackerOne](https://hackerone.com/roblox). Please refer to the linked page for rules of the bounty program.`