IssueMint treats imported YAML as untrusted input. The application is intentionally browser-only: it has no backend, login, analytics, telemetry, advertising, AI integration, or GitHub API access, and it must never execute imported content.

Security fixes are applied to the latest supported release line.

Please report a suspected vulnerability privately with GitHub's private vulnerability reporting form. Do not open a public issue before a fix or mitigation is available.

Include, when safe to do so:

• the affected version, browser, and operating system;
• a concise description of the impact and threat model;
• reproducible steps or a minimal, non-sensitive YAML fixture;
• any suggested mitigation;
• whether the issue has been disclosed elsewhere.

Never include credentials, tokens, private repository data, or another person's personal information. A maintainer will acknowledge the report, investigate it, coordinate a fix and disclosure when warranted, and credit reporters who want attribution. Response time can vary with severity and maintainer availability.

Useful reports include cross-site scripting or unsafe Markdown behavior, code execution from imported data, path traversal in downloaded files or ZIP entries, unsafe YAML parsing, unintended network transmission, persistence leaks, dependency vulnerabilities with a demonstrated path in IssueMint, and bypasses of export validation.

IssueMint does not claim that its GitHub-style preview is a security sandbox for arbitrary HTML. Raw imported HTML is not executed. Social engineering, availability of third-party static hosting, and vulnerabilities that require a user to modify and run the source locally outside the documented threat model are generally out of scope unless they expose other users.

Please allow maintainers a reasonable opportunity to reproduce and address the problem before public disclosure. Once a fix is available, the project will document user-relevant security changes in the changelog and release notes.