KINAVIS is a navigation library: it turns sensor readings, chart data and a vessel's settings into positions, courses, collision assessments and alerts. The worst thing it can do is not crash — it is to hand the officer of the watch a confident wrong number. This document says what we consider a vulnerability, how to report one, what the threat model is, and how the claims below are checked rather than made.

Please do not open a public issue for a suspected vulnerability.

• Preferred: GitHub's private vulnerability reporting on the repository (Security → Report a vulnerability), where it is enabled.
• Otherwise: email the maintainer at the address in Cargo.toml (authors), with [KINAVIS security] in the subject.

Include the crate and version, the input that triggers the problem (a sentence, a frame, a JSON document, a sequence of observations), and what happened against what should have. A minimal reproduction as a test or a fuzz-crash file is ideal; a description is enough.

You will get an acknowledgement within 7 days and a fix or a considered answer within 90. Fixes ship as patch releases of every affected crate, with a RUSTSEC advisory requested when the problem is reachable from untrusted input. Reporters are credited in the advisory unless they prefer not to be.

Older releases are not patched; upgrade. The minimum supported Rust version is stated in Cargo.toml (rust-version) and tested in CI.

Anything that breaks one of these promises on data the caller did not control:

1. No panic, no abort, no unbounded work. Every public function returns a value or an error for every input, in bounded time and bounded memory. A panic, an infinite loop, a stack overflow or an out-of-bounds read reached from an NMEA sentence, a CAN frame, an AIS payload or a stored file is a vulnerability.
2. No silently wrong number. An arithmetic overflow, a non-finite value, a truncation or a unit mix-up that produces a plausible but wrong result is a vulnerability — a more serious one than a crash, because it is acted on.
3. No invariant bypass. Every type with an invariant (a latitude in range, a unit quaternion, a positive-definite covariance, a table that can be inverted) is constructed through a checked constructor, including when it is read back through serde. A way to obtain an invalid value of such a type without unsafe is a vulnerability.
4. No hidden unsafe, no hidden allocation. unsafe_code is forbidden in every crate; the no_std configuration has no allocator. Either appearing is a vulnerability in the build, not only in the code.

Not vulnerabilities, but welcome as ordinary issues: a wrong answer on a valid input (a bug in the mathematics), a limit that is too small for a real installation, a missing check on a trusted argument, performance.

The integrity of the navigation solution and of what is shown or alarmed from it: the position and its error ellipse, the course to steer, the traffic picture and its collision assessments, the standing alerts. And the availability of the process that computes them: a navigation task that panics or hangs on a malformed sentence has failed the watch.

 untrusted                     the crates                          trusted
 ─────────                     ──────────                          ───────
 NMEA 0183 bytes ──▶ kinavis-nmea0183    ──▶ typed sentences ─┐
 AIS payloads    ──▶ kinavis-ais         ──▶ Message ─────────┤
 CAN frames      ──▶ kinavis-nmea2000    ──▶ Message ─────────┼──▶ observations ──▶ estimator, traffic ──▶ views, events ──▶ alerts
 stored files    ──▶ serde (try_from)    ──▶ Route, tables ───┘                 ▲
                                                                               │
                                              the vessel's settings, built in code by the integrator

• Untrusted: bytes off the wire and off the disk. Anything that arrives as bytes — NMEA 0183 sentences, NMEA 2000 frames, AIS payloads, JSON or any other serde form — may be malformed, truncated, oversized, contradictory or crafted. The parsers are the only place these enter, and they promise the four properties above on any byte sequence.
• Semi-trusted: well-formed observations. A syntactically valid fix, heading or target report may still be wrong or hostile: a spoofed GNSS position, a jammed receiver reporting garbage with a clear conscience, an AIS transponder inventing identities. The library does not authenticate sources (AIS and NMEA have no means to), but it bounds what one can do: the estimator gates each observation against its own prediction and keeps a health verdict per source; the traffic picture rejects implausible jumps and has a stated policy for a flood of new identities; the alert board is finite and keeps the most pressing.
• Trusted: the integrator's code. Configuration — gates, limits, policies, tracking thresholds — is built by the calling program through checked constructors and is not an attack surface in itself; a configuration that would make the vessel unsafe is refused where it can be recognised (a negative limit, a zero alert distance), not second- guessed where it cannot.

• Authentication of the data itself. AIS, NMEA 0183 and NMEA 2000 carry no signature; a transponder may say what it likes. The library bounds the damage a lying source can do and reports the suspicion; deciding whom to believe is the integrator's and the watch's.
• The transport and the host. Serial lines, CAN controllers, the RTOS, the process that owns the memory: their integrity is assumed.
• Timing side channels. Nothing here is a secret; execution time may depend on the input.
• Denial of service by volume. The library processes one input in bounded time; how many inputs per second the host accepts is the host's to limit.
• The correctness of the chart, the almanac and the magnetic model. They are inputs. A wrong datum or a stale WMM gives a wrong answer with a clear conscience; the library can only refuse what it can recognise as impossible.

Every claim in this document is a CI job or a test, not a policy:

• Feed the parsers everything and trust nothing until it has a type; the Err you get back is the point, log it and move on.
• Read the events. A rejected observation, a suspect sensor, an evicted target and a dropped alert are all reported as values; a program that discards them has discarded the library's view of what is wrong.
• Choose WhenFull and TrackingPolicy::max_speed for your waters; the defaults are conservative, not universal.
• Size the stack from the Memory table in the guide (kinavis::guide), or put the aggregates in static storage.
• Pin the crate versions and let cargo deny/cargo audit run in your own CI: this library's advisories will reach you that way.