Mihaela Mihaljevic
8d30010e0d
- README, roadmap: XSTS status quad and gates table now read the enforced 0/43/0/31 (Tests/XSTSSuiteTests.swift); test count 986/169 to 1448/258; encoding list and the remaining-work section reflect shipped reality; check-all expansion lists the validation and changelog gates - GEMINI.md, onboarding-antigravity.md: valid-schemas-rejected 1 to 0 and the pinned baselines updated to current - SECURITY.md: complete the reporting address - Parsing.InputEncoding: doc comment lists the full shipped encoding set - Schema.XSDParserUnion: guard the localName interpolation with ?? "" to match the same line and silence an optional-interpolation warning (internal dedup key, behavior preserving) - CHANGELOG: Unreleased entries for the above
30 lines
1002 B
Markdown
30 lines
1002 B
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
If you believe you have found a security issue in PureXML, please report it
|
|
privately. Do not open a public issue for security problems.
|
|
|
|
Email **mihaelamj@gmail.com** with:
|
|
|
|
- A description of the issue and its impact.
|
|
- Steps to reproduce, or a proof of concept.
|
|
- The affected version or commit.
|
|
|
|
You can expect an acknowledgement within a few days. Once the issue is confirmed,
|
|
a fix will be prepared and a release cut, after which the issue can be disclosed
|
|
publicly with credit to the reporter if desired.
|
|
|
|
## Supported versions
|
|
|
|
PureXML is pre-1.0 and under active development. Security fixes are applied to
|
|
the `main` branch. Until a stable release exists, only the latest `main` is
|
|
supported.
|
|
|
|
## Scope
|
|
|
|
PureXML parses and emits XML. Reports about parser denial-of-service vectors
|
|
(such as entity-expansion or deeply nested input), or about emitter output that
|
|
fails to escape special characters and enables injection downstream, are in
|
|
scope.
|