EconGym is a research library. Security fixes are applied to the latest released
version on the main branch.
| Version | Supported |
|---|---|
| 0.2.x | ✅ |
| < 0.2 | ❌ |
EconGym is numpy-only by default and does not execute untrusted input, open
network connections, or persist credentials, so the attack surface is small. If
you nonetheless discover a security issue (for example, a code-execution path via
a maliciously crafted saved artifact, or a supply-chain concern in the optional
[interop] / [rl] extras), please report it privately rather than opening a
public issue.
- Use GitHub's private vulnerability reporting on the repository ("Security" tab → "Report a vulnerability"), or
- open a minimal issue asking a maintainer to open a private channel (do not include exploit details in the public issue).
Please include a description, reproduction steps, affected version, and impact. We aim to acknowledge reports within a week and to provide a remediation timeline after triage.
In scope: the econgym package and its packaging metadata. Out of scope:
vulnerabilities in third-party dependencies (report those upstream to gymnasium,
pettingzoo, supersuit, stable-baselines3, or numpy), and issues that require a
pre-compromised local environment.