SECURITY.md (1380B)
1 # Security Policy 2 3 ## Supported Versions 4 5 I recommend to use stable version. 6 7 If you want real bugs and errors, then use our beta verion and say us how is it! 8 ```html 9 <script src="https://cdn.jsdelivr.net/gh/NodeX-AR/Pytml@Beta-Version/pytml.js"></script> 10 ``` 11 12 | Version | Supported | 13 | ------- | ------------------ | 14 |* 2.5 | :white_check_mark: | 15 | 2.4 | :white_check_mark: | 16 | 2.3 | :white_check_mark: | 17 | 2.2 | :white_check_mark: | 18 | 2.1 | :white_check_mark: | 19 | < 2.0 | :x: | 20 21 >*This version is latest and we made it into production. The version is tested on various angles on production itself. 22 23 ## Security Updates: 24 25 - Pytml defaults to using `element.text`, which uses the browser's textContent API. This means it is 100% secure against ***Cross-Site Scripting (XSS) attacks***. 26 If you must use element.html to render raw HTML, never pass untrusted user input directly into it. Use the built-in `pytml.escape()` helper to sanitize the input first. 27 28 ## Reporting a Vulnerability 29 30 First off Thanks! 31 You can open a [Issue](https://github.com/nodex-ar/pytml/issues) and report your bugs or if its a security bug the report it on our [security advisory](https://github.com/NodeX-AR/Pytml/security/advisories/new). 32 If you are confident about how to fix it then fork this respo, fix the bug then open a pr. We will look after that !