photon is a research/reference project, not a production service, but security reports are still taken seriously; the receiver does parse untrusted bytes off a network socket.

Please do not open a public issue for security problems. Instead, use GitHub private vulnerability reporting so there is time to fix before disclosure.

Include what you can: the input that triggers the problem (a crafted datagram or file is ideal), the build preset, and your environment.

Most interesting: anything reachable from the wire, i.e. the ITCH decode path (src/common/itch_protocol.hpp, src/photon/receiver.cpp) and the replayer's file parsing. Crashes that require running with sudo on an attacker-controlled machine are out of scope.