NodetteHQ/PureYAML
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
29ecce451a
PureYAML/SECURITY.md

989 B
Raw Blame History

Security Policy

Reporting a vulnerability

If you believe you have found a security issue in PureYAML, please report it privately. Do not open a public issue for security problems.

Email mihaelamj.com with:

  • A description of the issue and its impact.
  • Steps to reproduce, or a proof of concept.
  • The affected version or commit.

You can expect an acknowledgement within a few days. Once the issue is confirmed, a fix will be prepared and a release cut, after which the issue can be disclosed publicly with credit to the reporter if desired.

Supported versions

PureYAML is pre-1.0 and under active development. Security fixes are applied to the main branch. Until a stable release exists, only the latest main is supported.

Scope

PureYAML generates static sites. The generated output is plain HTML, CSS, and client-side JavaScript for rich tiles. Reports about generated output (for example, missing output escaping that enables script injection) are in scope.