NodetteHQ/PureXML
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases 1 Wiki Activity
perf/serialize-probe3
PureXML/SECURITY.md
Mihaela Mihaljevic 8d30010e0d docs: align stale figures with code and the enforced XSTS gate 
- README, roadmap: XSTS status quad and gates table now read the enforced
  0/43/0/31 (Tests/XSTSSuiteTests.swift); test count 986/169 to 1448/258;
  encoding list and the remaining-work section reflect shipped reality;
  check-all expansion lists the validation and changelog gates
- GEMINI.md, onboarding-antigravity.md: valid-schemas-rejected 1 to 0 and the
  pinned baselines updated to current
- SECURITY.md: complete the reporting address
- Parsing.InputEncoding: doc comment lists the full shipped encoding set
- Schema.XSDParserUnion: guard the localName interpolation with ?? "" to match
  the same line and silence an optional-interpolation warning (internal dedup
  key, behavior preserving)
- CHANGELOG: Unreleased entries for the above
2026-06-19 23:32:04 +02:00

1002 B
Raw Permalink Blame History

Security Policy

Reporting a vulnerability

If you believe you have found a security issue in PureXML, please report it privately. Do not open a public issue for security problems.

Email mihaelamj@gmail.com with:

  • A description of the issue and its impact.
  • Steps to reproduce, or a proof of concept.
  • The affected version or commit.

You can expect an acknowledgement within a few days. Once the issue is confirmed, a fix will be prepared and a release cut, after which the issue can be disclosed publicly with credit to the reporter if desired.

Supported versions

PureXML is pre-1.0 and under active development. Security fixes are applied to the main branch. Until a stable release exists, only the latest main is supported.

Scope

PureXML parses and emits XML. Reports about parser denial-of-service vectors (such as entity-expansion or deeply nested input), or about emitter output that fails to escape special characters and enables injection downstream, are in scope.