From ca9c0a717ba998427f1a70668ed7ca107dc19068 Mon Sep 17 00:00:00 2001 From: Tim Gossrau Date: Fri, 18 Sep 2026 13:05:53 +0200 Subject: [PATCH 1/7] docs: add security policy Private vulnerability reporting is now enabled on the repository, so there is a non-public channel to point reporters at. Without one, the only route was a public issue, which is itself the disclosure. The scope section draws the line at markup the attacker already controls: the library reflects the DOM it is handed, so an author- supplied