krz/orgo

Lightning fast org-mode static site generator.

clone: git clone https://gitbay.org/krz/orgo.git

5a02e39f580690a81970fd2a56c5454935d76b9b

unsigned

author: Christian Cleberg <hello@cleberg.net> · 2026-08-11T22:23:15Z

Keep SECURITY.md as markdown

GitHub's *Report a vulnerability* affordance and the Security-tab link look for
that filename specifically, and a security policy nobody can find is worse than
one written in the wrong markup.

Restored from the original file rather than converted back: a round trip through
two converters is a worse copy than the one that was already there. It is
byte-identical to what was committed yesterday.

 SECURITY.org => SECURITY.md | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/SECURITY.org b/SECURITY.md
similarity index 62%
rename from SECURITY.org
rename to SECURITY.md
index 7ee6e4e..41247c4 100644
--- a/SECURITY.org
+++ b/SECURITY.md
@@ -1,28 +1,32 @@
-* Security Policy
-** Supported Versions
-| Version        | Supported |
-|—————-+———--|
-| latest release | yes       |
-| anything older | no        |
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| latest release | yes |
+| anything older | no |
 
 Fixes land in a new release rather than as patches to an old one.
 
-** Reporting
-Email [[mailto:hello@cleberg.net][hello@cleberg.net]], or open a private advisory through GitHub's /Security/ tab.
+## Reporting
+
+Email <hello@cleberg.net>, or open a private advisory through GitHub's *Security* tab.
 Please do not open a public issue for something exploitable.
 
-** What is worth reporting
-orgo reads org files and writes HTML, so the interesting cases are about what a /document/
+## What is worth reporting
+
+orgo reads org files and writes HTML, so the interesting cases are about what a *document*
 can make it do:
 
 - Content from a source file escaping into HTML unescaped — a page that can inject script
   into the site it is published on.
 - A path in a document or config that writes outside the output directory.
-- The =serve= development server reachable, or made reachable, beyond loopback, or serving
+- The `serve` development server reachable, or made reachable, beyond loopback, or serving
   files from outside the output directory.
 - A crash, hang or unbounded allocation triggered by a crafted org file. A build that
   refuses a file is fine; one that never finishes is not.
 
-Out of scope: =--strict= not catching something, an unhandled org construct rendering
+Out of scope: `--strict` not catching something, an unhandled org construct rendering
 oddly, and anything requiring you to run orgo against files you already do not trust while
 also deploying the result unread.