Security fixes are made in the latest release. Please update to it before reporting a problem.

Do not open a public issue for a security problem. Report it privately through GitHub security advisories with the Mirab version, the platform and, if possible, a file or steps that reproduce it.

You will get a reply within a week. Once a fix is released, the advisory is published with credit to the reporter, unless they prefer otherwise.

Input files from untrusted sources (.inp, .msx, shapefiles, DXF, GeoTIFF) are the most likely way to attack Mirab, so problems in how they are read are in scope.