Mihaela Mihaljevic
708390242c
Root Swift package mirroring PureYAML's structure, rules, and verification gates. Includes the XML node model (Node, Element, Attribute, QualifiedName), a working emitter (Serializer) with escaping and pretty/compact options, and structural validation. The parser surface is stable; parse() raises notImplemented until the scanner lands, pinned by a test. - dependency-free, namespaced under PureXML - portability and style gates carried over (style, namespacing, forbidden patterns, swiftformat, swiftlint, linux, wasm, windows CI) - 11 tests passing
30 lines
996 B
Markdown
30 lines
996 B
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
If you believe you have found a security issue in PureXML, please report it
|
|
privately. Do not open a public issue for security problems.
|
|
|
|
Email **mihaelamj.com** with:
|
|
|
|
- A description of the issue and its impact.
|
|
- Steps to reproduce, or a proof of concept.
|
|
- The affected version or commit.
|
|
|
|
You can expect an acknowledgement within a few days. Once the issue is confirmed,
|
|
a fix will be prepared and a release cut, after which the issue can be disclosed
|
|
publicly with credit to the reporter if desired.
|
|
|
|
## Supported versions
|
|
|
|
PureXML is pre-1.0 and under active development. Security fixes are applied to
|
|
the `main` branch. Until a stable release exists, only the latest `main` is
|
|
supported.
|
|
|
|
## Scope
|
|
|
|
PureXML parses and emits XML. Reports about parser denial-of-service vectors
|
|
(such as entity-expansion or deeply nested input), or about emitter output that
|
|
fails to escape special characters and enables injection downstream, are in
|
|
scope.
|