beer-text runs in the browser with no dependencies, no network requests and no HTML parsing: the heading's text only ever goes into the page as text, and color options are accepted only when they are real CSS colors.

Please report a vulnerability privately through GitHub: the repository's Security tab, then Report a vulnerability. Don't open a public issue for it. Expect a first reply within a week.

The latest published version gets fixes.