Only the latest version, as deployed at https://solid-memo.com/, is supported. A fix is made on main and released as a new version, which is then deployed; older versions and forks get no fixes.

Report it privately through GitHub: Report a vulnerability. You need a GitHub account. Only you and the maintainers see the report.

Please do not open a public issue, pull request or discussion about it.

Say what is affected, how to reproduce it, and what an attacker could do with it. A proof of concept against your own pod is welcome; do not test against other people's pods or accounts.

This private channel is one of the two exceptions to the project's rule that it talks only in public (GOVERNANCE.md). The report is still handled in writing, in the private advisory, and is disclosed as What happens next says. A report that is not a vulnerability in scope is closed with its reason, and anything in a report that is not about a vulnerability, such as a feature idea, goes to the public channels.

Solid Memo is maintained by one volunteer, in his own time (GOVERNANCE.md), so these are aims, not promises:

• We acknowledge the report within a week.
• We say whether we accept it, and why, once we have looked into it.
• We fix an accepted vulnerability as soon as we can, on main, and release and deploy the fix as a new version.
• We disclose it in a GitHub security advisory once the fix is deployed, crediting you unless you would rather not be named. We agree the timing with you.

Solid Memo is a static site: everything runs in the user's browser, and it reads and writes the user's own Solid pod. In scope:

• The Solid-OIDC session: login, session restore and logout, and the requests made with the session (docs/authentication.md).
• Markdown rendering and the content security policy: any way data from a pod, a deck or a link runs script, loads content or misleads the user (docs/markdown.md).
• Deck import by URL: adding a deck or a course from a link to its release, and the Studio's import of files (docs/deck-library.md, docs/studio.md).
• Pod writes during migrations: a format update or a library upgrade that loses, exposes or corrupts a user's data (docs/migrations.md).
• The vocabulary, shapes and decks published at solid-memo.com, and this repository's CI and deploy workflows.

Out of scope:

• Users' own pod servers and identity providers, and the Solid servers the tests run against. Report those to their projects.
• GitHub Pages, which hosts the site, and the libraries the app depends on, unless Solid Memo uses them in an unsafe way. Report a library's own vulnerability to that library.

GitHub's CodeQL scans the code on each push to main, on pull requests from branches of this repository (not from forks) and once a week, for security flaws and coding errors, such as a regular expression that filters HTML badly or checks only part of a hostname. Its alerts are listed under the repository's Security tab. They are found by a tool, not reported by a person, so they are not handled as private reports: each is fixed in a public pull request, like any other change, and its commit says what CodeQL flagged and why the change fixes it (docs/testing.md). A vulnerability you find yourself still goes through Reporting a vulnerability.