Security updates are provided for:
| Version | Supported |
|---|---|
| Latest | ✅ |
| Active Major Versions | ✅ |
| Deprecated Versions | ❌ |
Older versions may contain known vulnerabilities and are not guaranteed to receive security fixes.
If you discover a security issue:
- Do NOT open a public issue
- Report the vulnerability privately to the maintainer
- Include as much detail as possible
Recommended information:
- Description of the issue
- Steps to reproduce
- Potential impact
- Proof of concept (if applicable)
- Suggested mitigation or fix
This repository hosts documentation generated using Docusaurus.
Relevant security concerns include:
- Malicious MDX content
- Embedded scripts
- Unsafe external links
- Untrusted third-party assets
- Vulnerable npm packages
- Vulnerable transitive dependencies
- Supply-chain attacks
- GitHub Actions workflow abuse
- GitLab CI/CD pipeline abuse
- Excessive permissions
- Secret leakage
- Cross-site scripting (XSS)
- Content injection
- Unsafe redirects
- Insecure third-party integrations
- Keep dependencies up to date
- Review dependency updates before merging
- Remove unused packages
- Avoid embedding untrusted scripts
- Avoid embedding untrusted iframes
- Verify external links before publishing
- Use least-privilege permissions
- Avoid storing secrets in source control
- Review workflow changes carefully
- Protect main branch
- Require pull requests for changes
- Review external contributions
Never commit:
- API keys
- Access tokens
- Passwords
- Private certificates
- Environment files containing secrets
Examples:
.env
.env.production
.env.local
Sensitive values should be stored using:
- GitHub Secrets
- GitLab CI/CD Variables
- External secret management solutions
The maintainer will:
- Investigate reported issues
- Assess impact and severity
- Develop and validate a fix
- Release security updates when necessary
- Credit reporters when appropriate
Security issues should be reported privately.
Public disclosure should occur only after:
- A fix is available, or
- The maintainer has been notified and given reasonable time to respond.
Thank you for helping keep this project secure.