krz/orgo

Lightning fast org-mode static site generator.

clone: git clone https://gitbay.org/krz/orgo.git

d78e4ddb72b2733aeaf6800ac5e98c55abd8a017

verified · cmc

author: Christian Cleberg <hello@cleberg.net> · 2026-08-11T21:49:50Z

Add dependabot, funding and a security policy

Dependabot covers cargo and the actions, both weekly and both grouped. The
action pins matter most: a SHA pin never moves on its own, which is the point,
and also means nothing tells you it has gone stale.

The security policy says what is actually worth reporting for a program whose
whole job is turning someone's documents into HTML — content escaping into the
page unescaped, a path that writes outside the output directory, the dev server
reaching past loopback, or a crafted file that never finishes building.

 .github/FUNDING.yml    |  1 +
 .github/dependabot.yml | 26 ++++++++++++++++++++++++++
 SECURITY.md            | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 59 insertions(+)

diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 0000000..4b822e5
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1 @@
+github: [ccleberg]
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..cc765b6
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,26 @@
+# Dependabot version updates.
+#
+# Two ecosystems, both weekly: the crates this is built from, and the actions the
+# workflows pin by SHA. The action pins are the reason this matters more than usual —
+# a pinned SHA never moves on its own, which is the point, and also means nothing tells
+# you it has gone stale unless something does.
+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    # A dependency bump can change rendered output — syntect owns the highlighting, and
+    # its syntax definitions are data. Grouping keeps that reviewable as one diff rather
+    # than five PRs landing in an order nobody chose.
+    groups:
+      rust-dependencies:
+        patterns: ["*"]
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions:
+        patterns: ["*"]
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..41247c4
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,32 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| latest release | yes |
+| anything older | no |
+
+Fixes land in a new release rather than as patches to an old one.
+
+## Reporting
+
+Email <hello@cleberg.net>, or open a private advisory through GitHub's *Security* tab.
+Please do not open a public issue for something exploitable.
+
+## What is worth reporting
+
+orgo reads org files and writes HTML, so the interesting cases are about what a *document*
+can make it do:
+
+- Content from a source file escaping into HTML unescaped — a page that can inject script
+  into the site it is published on.
+- A path in a document or config that writes outside the output directory.
+- The `serve` development server reachable, or made reachable, beyond loopback, or serving
+  files from outside the output directory.
+- A crash, hang or unbounded allocation triggered by a crafted org file. A build that
+  refuses a file is fine; one that never finishes is not.
+
+Out of scope: `--strict` not catching something, an unhandled org construct rendering
+oddly, and anything requiring you to run orgo against files you already do not trust while
+also deploying the result unread.