Security fixes are applied to the latest released version of Rowpack.

Please use GitHub’s private vulnerability reporting for this repository:

https://github.com/victus17/rowpack/security/advisories/new

Include the affected version, a minimal reproduction and the expected impact. You should receive an acknowledgement within seven days. Please avoid sharing the issue publicly until a fix is available.

A Rowpack file is private in the sense that it does not upload or sync its contents. It is not encrypted. Anyone who can read the HTML file can inspect the embedded records.

See docs/security-model.md for the design and trust boundaries.