It's an incredible achievement, though I worry about the use of an unproven language (Zig) that lacks memory safety by design. JavaScript runtimes, especially those with JITs, have been plagued by vulnerabilities from memory safety, type confusion, and data races.<p>Node.js, despite being based on V8, is still susceptible <i>independently</i> of V8 and introduces its own vulnerabilities. It's not sufficient for the runtime to be secure, but the new facilities Bun provides must <i>also</i> be vetted.<p>Bun/Oven are new, and similar in position to Node. Here are the hard questions I'd ask if I were on a security team and asked to review adopting Bun:<p>1. Will Oven adopt a security policy for Bun? (<a href="https://github.com/oven-sh/bun/security" rel="nofollow">https://github.com/oven-sh/bun/security</a>)<p>2. What measures is Oven taking to proactively detect and mitigate vulnerabilities? (e.g.: fuzzing, audits, bug bounties)<p>3. Will Oven support Zig development to avoid an existential risk in upstream vulnerabilities?