Only the latest released version receives security fixes.

Please do not open a public issue for security problems. Instead, use GitHub's private vulnerability reporting on this repository (Security → Report a vulnerability), or contact the maintainer directly.

You can expect an acknowledgment within a week. Once a fix is available, the vulnerability will be disclosed in the release notes.

• ThermalBits executes bundled Rust binaries (iron_circuit_sim, eo_do_rs) and, optionally, external tools (ABC) via subprocess. It does not open network sockets; the entropy "server" is a local child process communicating over stdin/stdout pipes.
• Parsing untrusted Verilog/JSON files is within scope: crashes are expected to surface as Python exceptions, never as arbitrary code execution.