Security fixes are applied to the latest release and the main branch.

Use GitHub's private vulnerability reporting. Include the affected version, browser, reproduction steps, expected impact, and a minimal proof of concept. Do not include unrelated private information or publish exploitable details in an issue or discussion.

Please allow reasonable time for investigation before disclosure. This volunteer project does not promise a fixed response or remediation SLA.

HTML Runner uses browser sandboxing and CSP to reduce preview permissions. It is not a malware-analysis, antivirus, or operating-system isolation product. A report should demonstrate a boundary escape or a material failure of a stated control, such as:

• access from preview code to the parent DOM, cookies, or LocalStorage;
• top-level navigation, forms, popups, downloads, or other permissions not granted by the iframe;
• JavaScript or external network access in Strict Preview;
• acceptance of forged or stale Console bridge messages;
• editor source code leaving the browser through application code, analytics, or monitoring;
• a share fragment that causes JavaScript to execute automatically.

Expected browser behavior already documented in docs/SECURITY_MODEL.md—including tab hangs caused by infinite loops or network requests deliberately made by user code in Sandboxed Run—is not automatically a vulnerability.