Email security@textjs.org, or open a private report under the repository's Security tab. Don't open a public issue for a vulnerability.

Include the affected package and version, the steps to reproduce, and the impact you expect. We'll confirm that we received the report and keep you updated until a fix ships.

Security fixes are released for every supported release line at the same time. The Support Policy lists which lines are supported.

This policy covers the packages published from this repository (@textjs/*, create-text-app, eslint-plugin-textjs), the VS Code and Chrome DevTools extensions, and textjs.org.