Security

go2cs is a transpiler: it reads Go source and emits C#. The security surface that matters most is the generated code — a conversion defect that silently produces C# with different memory, bounds, or concurrency behavior than the Go it came from is treated as a security issue, not merely a correctness bug. Reports against the converter, the golib runtime, the go2cs-gen source generators, and the converted standard library under src/go-src-converted are all in scope.

Reporting Security Issues

Please report security vulnerabilities privately as described below, not through public GitHub issues.

Use GitHub’s private vulnerability reporting for this repository (Security → Report a vulnerability). This keeps the report confidential between you and the maintainer until a fix is available, and it does not expose an email address to be scraped.

When submitting the report, please include the information listed below to help clarify the nature and scope of the possible issue:

• Type of issue (e.g. buffer overflow, unbounded allocation, unsafe pointer handling, etc.)
• Full paths of source file(s) related to the manifestation of the issue
• The location of the affected source code (tag/branch/commit or direct URL)
• Whether the issue is in the converter itself or in the C# it generates
• The Go input that reproduces it, and the C# go2cs emitted for that input
• Any special configuration required to reproduce the issue
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit it

Preferred Languages

We prefer all communications to be in English.

Policy

go2cs follows the principle of Coordinated Vulnerability Disclosure. This is a single-maintainer project, so please allow a reasonable window for a response and a fix before any public disclosure.