Only the latest 0.1.x release receives security fixes.
Bier is in its first, alpha stage. Expect bugs and possibly security flaws — it is not ready for production use.
Please do not open a public issue for security problems. Instead, report them privately through GitHub's vulnerability reporting on this repository: https://github.com/milmazz/bier/security/advisories/new.
You should get an initial response within 7 days. Please keep the report private until a fix is released and give us a reasonable window to publish one before any public disclosure.
The injection-safety model — which user-controlled values reach SQL as bound
parameters and which are escaped as typed literals, and why — is documented in
docs/injection_safety.md. That page is the
intended starting point for an audit of the query builders.