Security updates are applied to the main branch.

Please report security vulnerabilities privately.

• Preferred: GitHub Security Advisory
  • https://github.com/supunlakmal/hash-calendar/security/advisories/new
• If advisory reporting is unavailable, open a private contact request through GitHub profile channels.

Please do not post exploit details in public issues.

• Affected component(s)
• Reproduction steps or proof of concept
• Impact assessment (confidentiality/integrity/availability)
• Suggested mitigation (if known)

• Initial triage target: within 7 days
• If confirmed, a fix will be prepared and coordinated for disclosure
• Credit will be given unless you request anonymity

hash-calendar is a client-only app with URL-hash state. Security-relevant areas include:

• Encryption/decryption behavior
• URL hash parsing/handling
• Data import parsing (.ics, JSON bridge)
• Third-party script loading and integration