SECURITY.md

gitbay-release-pipeline

build-output-and-docs-home gitbay-release-pipeline main pages pages-debug-profile runner-ssh-host All refs →

orgo/SECURITY.md rendered · source · history · blame · raw

32 lines · 1197 bytes

Security Policy

Supported Versions

Version	Supported
latest release	yes
anything older	no

Fixes land in a new release rather than as patches to an old one.

Reporting

Email security@krz.sh, or open a private advisory through GitHub's Security tab. Please do not open a public issue for something exploitable.

What is worth reporting

orgo reads org files and writes HTML, so the interesting cases are about what a document can make it do:

Content from a source file escaping into HTML unescaped — a page that can inject script into the site it is published on.
A path in a document or config that writes outside the output directory.
The serve development server reachable, or made reachable, beyond loopback, or serving files from outside the output directory.
A crash, hang or unbounded allocation triggered by a crafted org file. A build that refuses a file is fine; one that never finishes is not.

Out of scope: --strict not catching something, an unhandled org construct rendering oddly, and anything requiring you to run orgo against files you already do not trust while also deploying the result unread.