Security Policy

Supported Versions

Security fixes are applied to the latest code on the default branch. Older commits, tags, and forks are not maintained; please reproduce findings against the most recent code before reporting.

Reporting a Vulnerability

If you believe you have found a security vulnerability, please report it to us as soon as possible. We take all reports seriously and will do our best to address the issue promptly.

Do not create a public GitHub issue for the security vulnerability.

Instead, please follow these steps:

1. Email us at blocks@selisegroup.com with details of the vulnerability.
2. Include a thorough description of the issue, including any relevant information on the environment in which the vulnerability was discovered.
3. Allow some time for us to review and respond to your report.

What to Expect

• We aim to acknowledge new reports within a few business days.
• We will work with you to understand and validate the issue, and keep you informed while a fix is prepared.
• Please keep the details of the report confidential until a fix is released.

Responsible Disclosure

We appreciate the efforts of security researchers and the community in helping to keep our project and users safe. If you responsibly disclose a security issue, we commit to:

• Acknowledge and respond to your report promptly.
• Work with you to understand and validate the issue.
• Provide details on when and how the issue will be addressed.
• Give credit to the reporter, if agreed upon, upon resolution of the issue.

Scope

This security policy applies to the MailCraft email editor (the <mailcraft-editor> web component and this repository). Please note that this policy does not give you permission to hack, harm, or exploit our services. Any such attempts will be considered malicious and may be reported to the appropriate authorities.

Security-relevant surfaces particular to this package

When reviewing, pay special attention to the paths this package deliberately hardens:

• Untrusted input: imported HTML, pasted content, persisted localStorage drafts, and storage-provider responses are all treated as untrusted and sanitized (core/sanitize.js, core/import-html.js).
• CSS/attribute injection: image and background URLs are percent-encoded before interpolation into style attributes in the exported email (cssUrl); regressions here ship into recipients’ inboxes.
• SVG uploads: SVG is a script host and is refused unless a host explicitly opts in with both accept and allowSvg (core/storage-limits.js).
• Scoped styles: authored CSS is prefixed to the email sheet so a raw block can never restyle the editor chrome (scopeCss).

Updates

We may update this security policy from time to time. Check the file’s Git history for the most recent changes.

Thank you for helping to keep MailCraft secure!