Security fixes land on the current 1.x line. There is no 0.x line to
maintain — 1.0.0 is the first tagged release.
| Version | Supported |
|---|---|
| 1.0.x | ✅ |
| < 1.0 | ❌ |
Which file you embed decides how fixes reach you:
| URL | Gets |
|---|---|
cdn.gracker.ai/summarize.min.js |
The latest build, across major versions |
cdn.gracker.ai/summarize.v1.min.js |
The latest 1.x — security and bug fixes, never a breaking change |
Both are cached 5 minutes in the browser and 24 hours at the edge, so a fix reaches embedded pages on its own within about a day. A copy you host yourself is yours to update: rebuild from the matching tag.
Please do not open a public issue for a security report. Use either private channel:
- GitHub — Report a vulnerability, or the Security tab. Preferred: report, fix and advisory stay in one place.
- Email — security@gracker.ai
Helpful to include: the affected version or the page you saw it on, the browser, steps to reproduce, and what an attacker gains.
| Stage | Timing |
|---|---|
| Acknowledgement that we received it | Within 3 business days |
| Assessment and a severity decision | Within 7 business days |
| Fix for a confirmed high-severity issue | Shipped to the CDN as soon as it is ready |
If it is accepted, we fix it, publish an advisory, and credit you by name unless you would rather stay anonymous. If it is declined, we will tell you why — and if you disagree, send the reasoning back and we will look again.
In scope: widget/summarize.js and the built summarize.min.js, the widget
as served from cdn.gracker.ai, and the landing page in src/ and public/.
Out of scope:
- The AI providers themselves — ChatGPT, Claude, Gemini, Grok, Copilot, Perplexity, Google. Report those to the provider.
- The content of any page that embeds the widget.
- Dependabot alerts on
devDependencies. This project builds to static files and ships no server code, so build-time dependencies are not part of the deployed artifact. We still upgrade them — they are not a vulnerability in what your readers load.
Worth stating plainly, since it runs on other people's sites:
- Renders in a shadow root — it cannot read or restyle the host page, and the host page's CSS cannot reach into it.
- Makes no network requests of its own. Provider icons are inlined SVG.
- Reads
location.hrefanddocument.titleonly, and only when a reader activates a menu item. - Sends nothing anywhere until a reader clicks a provider, and then only as a normal link navigation carrying the prompt and the page URL.
- No cookies, no storage, no analytics, no backend.