We take security vulnerabilities seriously. If you believe you've discovered a security issue in js-beautify, please report it responsibly using GitHub's Private Vulnerability Reporting feature.
DO NOT open a public GitHub issue for security vulnerabilities.
Instead, use the private reporting feature:
- Go to the Security tab
- Click "Report a vulnerability"
- Fill out the form with details of the vulnerability
- Submit your report
This creates a private communication channel between you and the maintainers.
Please provide:
- Description of the vulnerability
- Steps to reproduce (or proof-of-concept)
- Affected versions
- Suggested remediation (if you have one)
- Your contact information (optional)
- Initial Response: Within 48 hours of submission
- Updates: We'll keep you informed of progress toward a fix
- Disclosure Coordination: We'll work with you on timing for public disclosure
When using js-beautify:
- Keep the package updated to the latest version
- Validate and sanitize all input data before beautifying
- Don't beautify untrusted code or markup in security-critical contexts
Once a vulnerability is patched:
- We'll publish a security advisory on GitHub
- Release notes will credit the researcher (unless requested otherwise)
- Users will be notified via GitHub's security alerts
For questions about this policy, please open a regular (non-security) GitHub issue.
Thank you for helping keep js-beautify secure! 🙏