The latest minor of the current major receives security fixes. The previous major receives them for six months after the new major ships. See docs/governance/versioning.md.

Report privately through GitHub Security Advisories, or by email to security@freecodefund.xyz. Do not open a public issue.

You should get an acknowledgement within two working days and an assessment within five.

A design system is mostly declarative, which narrows the surface but does not remove it:

• Injection through a component. A prop that reaches dangerouslySetInnerHTML, an unsanitised href accepting javascript:, or a value interpolated into a style attribute without escaping.
• CSS-based exfiltration. An attribute selector plus a background image can leak input values one character at a time. The system ships no such selector and should not gain one.
• Supply chain. A compromised dependency, or a published tarball whose contents do not match this repository. Releases are published with npm provenance; verify with npm audit signatures.
• Clickjacking affordances. A component that renders an interactive element under a transparent overlay.

• A contrast or accessibility defect. Those are bugs — file them publicly so they get fixed faster.
• A vulnerability in a consumer caused by passing unsanitised user content to a component documented as accepting trusted content.
• Denial of service through absurd prop values, such as a PointCloud with a density of one million.