Until 1.0, security fixes are released from the latest published minor line. After 1.0, the latest major release and the immediately previous major release receive fixes when a practical backport exists.

Use GitHub's private vulnerability reporting form:

https://github.com/phongndo/syntaxmate/security/advisories/new

Do not open a public issue for a suspected denial of service, panic reachable through untrusted grammar/theme/source input, terminal or HTML injection, bundle-validation flaw, or vulnerable dependency. Include a minimal reproducer, impact assessment, affected version, and any proposed mitigation. Maintainers will acknowledge a complete report within seven days and coordinate disclosure and a release when the issue is confirmed.

Syntaxmate treats grammar JSON, theme JSON, source text, and renderer input as untrusted. The tokenizer applies bounded fallback-regex and per-line work limits. HighlightStatus::Degraded reports when those limits prevent complete highlighting. HTML output escapes source and attributes; ANSI output sanitizes source control characters by default.

The release library is safe Rust and performs no network, filesystem, or process-environment access. Bundled assets are committed, checksummed, licensed, and built offline. Node dependencies under tools/golden-oracle are development-only and are not present in the crate archive.