Do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Use GitHub Security Advisories to report vulnerabilities privately:
- Go to the Writ repository on GitHub.
- Click the Security tab.
- Click Report a vulnerability.
- Fill in the advisory form with as much detail as possible.
If GitHub Security Advisories are not available to you, email the maintainer privately at:
Use the subject line [writ security] and include:
- A description of the issue and its potential impact.
- Steps to reproduce, or a proof-of-concept if you have one.
- The affected version (output of
writ --versionor the release tag). - Your operating system and architecture.
- You will receive an acknowledgement within 48 hours of your report.
- If the issue is confirmed, a patch will be prepared and released within 14 days for critical issues or 30 days for lower-severity issues.
- You will be kept informed throughout the process and credited in the advisory unless you request otherwise.
- Please allow us a reasonable window to ship a fix before public disclosure.
Only the most recent release on the main branch receives security fixes. We do not backport patches to older releases.
| Version | Supported |
|---|---|
latest 0.x release |
Yes |
older 0.x releases |
No |
Once Writ reaches a 1.x release, this table will be updated with a formal support window.
The following are in scope:
- Every Rust crate in the workspace:
writ-core,writ-storage,writ-plugin,writ-render,writ-lint, andwrit-cli(thewritcommand, which parses argv and piped stdin). - The
src-tauriTauri IPC layer and its command surface. - The SolidJS frontend under
src/. - Markdown and HTML rendering in the preview pane.
- SQLite database handling and FTS5 query construction.
- Release artifacts published under GitHub Releases.
The following are out of scope:
- Vulnerabilities in third-party dependencies (please report those upstream first).
- Issues that require physical access to the user's machine.
- Social engineering attacks.
- Denial of service via resource exhaustion on the user's own machine.