mirror of https://github.com/Manavarya09/design-extract.git synced 2026-09-19 02:41:14 +08:00

Files

T

Manav Arya Singh 63011145cf security: SECURITY.md + CodeQL + postcss >=8.5.10 override

- SECURITY.md: disclosure policy, supported versions, scope boundaries,
  points reports at GitHub's private vulnerability reporting.
- .github/workflows/codeql.yml: weekly + per-PR scan with
  security-and-quality query suite.
- website: postcss override to 8.5.10 to clear GHSA-qx2v-qp2m-jg93
  (XSS via unescaped </style> in CSS stringify). Next.js pulls the
  fixed version transparently; build unaffected.
- Private vulnerability reporting enabled via API (no file).

2026-04-24 23:55:07 +04:00

1.7 KiB

Raw Permalink Blame History

Security Policy

Supported versions

Version	Supported
11.x	✅
10.x	✅ (critical only)
< 10	❌

Only the latest minor of each supported major receives fixes.

Reporting a vulnerability

Please don't open a public issue. Use GitHub's private vulnerability reporting instead:

👉 https://github.com/Manavarya09/design-extract/security/advisories/new

What to include:

A description of the issue and its impact.
A minimal repro (URL being extracted, CLI flags, OS + Node version).
Suggested severity and, if you have one, a proposed fix.

What to expect

Acknowledgement within 72 hours.
A triage verdict (accepted / needs info / out of scope) within 7 days.
Public disclosure coordinated with you after a fix ships — usually as part of a patch release.

Scope

In scope:

The designlang CLI and all subcommands (extract, clone, ci, studio, replay, mcp, etc.).
The MCP server (src/mcp/server.js).
The hosted extractor website (website/) when used at its canonical URL.
The Figma, Chrome, Raycast, and VS Code extensions shipped in this repo.

Out of scope:

Vulnerabilities that require the user to run designlang against a page they themselves control (i.e. self-owned XSS in content they feed us).
Denial of service via crafted sites that simply take a long time to extract — we already time-bound Playwright operations.
Browser-level shadow-DOM opacity (closed shadow roots are unreachable by web platform design, not a designlang bug).

Thanks for taking the time to report responsibly.