| 1 | # Security Policy |
| 2 | |
| 3 | Dear ImGui is primarily designed for developer tools and technical applications running trusted code and trusted data. |
| 4 | |
| 5 | Given that the library was not designed as a hardened security boundary against hostile or intentionally malformed inputs: |
| 6 | consider not using it in a context where a crash (through e.g. intentionally malformed inputs) could lead to privilege elevation. |
| 7 | E.g. running in a privileged process and interacting with non-privileged clients feeding code or data to Dear ImGui. |
| 8 | |
| 9 | Dear ImGui development efforts are focused on improving developer experience, usability, correctness, and robustness in real-world applications. |
| 10 | We will do our best to reduce e.g. crashes caused by common programmer mistakes. |
| 11 | |
| 12 | However, the project does not specifically focus on adversarial fuzzing scenarios, allocation-failure hardening, or highly artificial edge cases that are unlikely to occur in normal usage. |
| 13 | |
| 14 | ## Reporting a Vulnerability |
| 15 | |
| 16 | Considering the above policy, most things may be reported in GitHub Issues. |
| 17 | If you have a reason to disclose privately, please reach out to the contact address listed in README. |