Fixes land in a new release rather than as patches to an old one.

Email security@krz.sh, or open a private advisory through GitHub's Security tab. Please do not open a public issue for something exploitable.

orgo reads org files and writes HTML, so the interesting cases are about what a document can make it do:

• Content from a source file escaping into HTML unescaped — a page that can inject script into the site it is published on.
• A path in a document or config that writes outside the output directory.
• The serve development server reachable, or made reachable, beyond loopback, or serving files from outside the output directory.
• A crash, hang or unbounded allocation triggered by a crafted org file. A build that refuses a file is fine; one that never finishes is not.

Out of scope: --strict not catching something, an unhandled org construct rendering oddly, and anything requiring you to run orgo against files you already do not trust while also deploying the result unread.