If you discover a security vulnerability in MarkupKit, please report it responsibly:
- Do not open a public issue.
- Include steps to reproduce, impact assessment, and any suggested fixes.
- We will acknowledge receipt within 48 hours and aim to resolve critical issues within 7 days.
MarkupKit is a client-side development tool. Its security surface includes:
- DOM reading and analysis (runs in the user's browser)
- No server-side code is included in this package
- No external network requests are made by default
- No credentials, tokens, or secrets are stored or transmitted
| Version | Supported |
|---|---|
| 1.x | ✅ Current |
| < 1.0 | ❌ No |
- Only use MarkupKit in development environments (
NODE_ENV === "development") - Do not ship MarkupKit to production bundles
- Review the source code if you have security concerns
- Keep the package updated to the latest version