Please do not open a public issue for security reports.

Use GitHub's private vulnerability reporting instead. Include the affected version, a description of the issue, reproduction steps, and the impact you expect.

You can expect an initial response within 7 days and a status update within 30 days.

This package performs arithmetic on timestamps supplied by the caller and holds no credentials, network connections, or persistent state. The realistic concerns are:

• Unbounded growth — a timeline retains every chunk recorded into it. A long-lived timeline that is never Reset grows with the stream, which a caller driven by untrusted input should bound.
• Caller-supplied timestamps — send times are trusted as given. A caller that derives them from a remote peer should validate them, since a far-future timestamp pushes the reconstructed end arbitrarily far forward.