If you discover a security vulnerability in this crate, do not open a public issue.

Please report it privately via one of:

• GitHub Security Advisories: Report a vulnerability
• Email: security@mosspiglet.dev

We will acknowledge receipt within 48 hours and provide a timeline for a fix.

This policy covers the metamorphic-crypto Rust crate, including:

• All cryptographic operations (secretbox, box_seal, hybrid KEM, KDF)
• WASM bindings
• Key generation and management
• Recovery key encoding

• #![forbid(unsafe_code)] — no unsafe Rust
• All dependencies are from the audited RustCrypto project
• ML-KEM-768/1024 implementation via the ml-kem crate (FIPS 203)
• Secret key material zeroized after use via zeroize
• OS CSPRNG only (no userspace PRNG)
• Constant-time operations for all MAC comparisons