Security

Reporting a vulnerability

• Primary channel: github.com/themvora/themvora/security/advisories — this creates a private advisory visible only to the maintainers.
• Email: themvoraproductions@gmail.com — for reports that can't use the advisory system, you can email the maintainers directly. Please use a descriptive subject line and include as much detail as possible.
• Do not file a public GitHub issue for a security vulnerability. Use the private advisory system or email instead.
• For non-critical questions, you can open a regular discussion or issue — but if you are unsure, the advisory system or email is safer.

What is in scope

• The @themvora/* packages — core, framework integrations, adapters, and CLI.
• The blocking bootstrap script and the pre-paint CSS — these run inline in your application and must not introduce injection vectors.

What is out of scope

• Vulnerabilities in the frameworks Themvora integrates with (Next.js, Nuxt, Astro, etc.) — report those to the respective projects.
• Transitive dependency advisories in framework peer dependencies (for example, a postcss vulnerability in Next.js). The @themvora/* packages have no third-party runtime dependencies apart from tslib in @themvora/angular ; the advisory tree of your application is determined by the frameworks you choose.

Our process

When we receive a report through the advisory system, we will:

• acknowledge receipt within a few business days.
• triage and determine severity and affected versions.
• prepare a fix and release it through the normal release process. Critical issues may warrant an immediate patch release.
• publish the advisory after the fix is released, with credit to the reporter if they wish.

Thanks

We appreciate responsible disclosure and will acknowledge reporters who prefer to be credited in the advisory and release notes.