krz/orgo

 1# Security Policy
 2
 3## Supported Versions
 4
 5| Version | Supported |
 6|---------|-----------|
 7| latest release | yes |
 8| anything older | no |
 9
10Fixes land in a new release rather than as patches to an old one.
11
12## Reporting
13
14Email <security@krz.sh>, or open a private advisory through GitHub's *Security* tab.
15Please do not open a public issue for something exploitable.
16
17## What is worth reporting
18
19orgo reads org files and writes HTML, so the interesting cases are about what a *document*
20can make it do:
21
22- Content from a source file escaping into HTML unescaped — a page that can inject script
23  into the site it is published on.
24- A path in a document or config that writes outside the output directory.
25- The `serve` development server reachable, or made reachable, beyond loopback, or serving
26  files from outside the output directory.
27- A crash, hang or unbounded allocation triggered by a crafted org file. A build that
28  refuses a file is fine; one that never finishes is not.
29
30Out of scope: `--strict` not catching something, an unhandled org construct rendering
31oddly, and anything requiring you to run orgo against files you already do not trust while
32also deploying the result unread.