Security Policy
Supported Versions
| Version |
Supported |
| 1.4.x |
:white_check_mark: |
| 1.3.x |
:white_check_mark: |
| < 1.3 |
:x: |
Reporting a Vulnerability
If you discover a security vulnerability within SSG, please send an email to spagu@github.com. All security vulnerabilities will be promptly addressed.
Please do not open a public GitHub issue for security vulnerabilities.
What to Include
When reporting a vulnerability, please include:
- Description: A clear description of the vulnerability
- Steps to reproduce: How can we reproduce the issue?
- Impact: What is the potential impact?
- Version: Which version of SSG is affected?
Response Timeline
- Initial Response: Within 48 hours
- Status Update: Within 7 days
- Fix Release: Within 30 days for critical issues
Security Best Practices
For Users
- Keep SSG Updated: Always use the latest version
- Validate Input: Sanitize content before processing
- Review Templates: Audit custom templates for XSS vulnerabilities
- Use HTTPS: Deploy generated sites over HTTPS
- Content Security Policy: Configure appropriate CSP headers
For Template Authors
- Escape Output: Always escape user-provided content
- Avoid Inline JS: Use external JavaScript files
- Validate URLs: Check URLs before rendering links
- Sanitize HTML: Use HTML sanitization for user content
Built-in Security Features
SSG includes several security features:
- Path Traversal Protection: Prevents directory traversal attacks when extracting themes
- Content Escaping: HTML templates automatically escape content
- Secure Defaults: Safe configuration defaults
- No Eval: No dynamic code execution from templates
Security Updates
Security updates are released as patch versions (e.g., 1.4.1, 1.4.2). Subscribe to releases on GitHub to stay informed.
Acknowledgments
We appreciate security researchers who responsibly disclose vulnerabilities. Contributors will be acknowledged in release notes (unless they prefer to remain anonymous).