Only the latest 2.0.0 prerelease of components-web-app/api-components-bundle gets security fixes. Older alphas are not patched: upgrade to the latest release.

Vulnerabilities in the Nuxt module or the template can be reported the same way, on cwa-nuxt-module or components-web-app.

Please don't open a public issue, pull request or discussion for a security problem. Report it privately:

• on GitHub: Security tab → Report a vulnerability (private vulnerability reporting), or
• by email to hello@cwa.rocks.

Include:

• the bundle version (and the module and template versions, if relevant),
• what is affected and how it could be exploited,
• steps to reproduce, or a proof of concept,
• any fix or mitigation you have in mind.

We aim to acknowledge a report, keep you updated while we look into it, and credit you when a fix is released, unless you'd rather stay anonymous. This is a small open-source project: there is no guaranteed response time, no bug bounty, and the software is provided "as is", without warranty, under the MIT licence.