From f1fb943c69661d939b8c0c31f15e253b064c236b Mon Sep 17 00:00:00 2001 From: LongYinan Date: Thu, 30 Jul 2026 09:10:16 +0800 Subject: [PATCH 1/2] docs: add SECURITY.md --- SECURITY.md | 65 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..0fd703d66 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,65 @@ +# Security Policy + +## Supported Versions + +Security fixes are provided for the latest released version of SWC and the +`main` branch. + +Older releases may receive fixes at the maintainers' discretion, but they are +not guaranteed to receive security updates. + +## Reporting a Vulnerability + +Please do not report security vulnerabilities in a public GitHub issue. + +Report suspected vulnerabilities privately by emailing: + + + +Please include enough information for maintainers to reproduce and assess the +issue, such as: + +- The affected package, crate, version, or commit +- Steps to reproduce the issue +- The expected and actual behavior +- The security impact +- Any suggested fix, mitigation, or related context + +Maintainers will review the report and coordinate investigation, fixes, and +public disclosure when appropriate. + +## Security Model + +SWC is a build tool. SWC does not support processing untrusted input and does +not provide isolation, resource containment, or other sandbox guarantees. It is +not designed to be a SaaS platform, a multi-tenant sandbox, or a security +boundary for executing or transforming arbitrary untrusted input. This applies +regardless of the input language, syntax, file type, or SWC package used to +process it. + +If you operate SWC in a service that accepts input from untrusted users or +tenants, you are responsible for validating that input before passing it to SWC +and for applying appropriate isolation, resource limits, privilege separation, +and operational controls around the process. + +## Scope + +Security reports are in scope when they affect SWC itself, including: + +- Official Rust crates, in all supported usage +- Official npm packages when used as build tools, including CLI and development + server integrations +- Official bindings and release artifacts +- Parser, compiler, bundler, transform, minifier, and code generation behavior +- Issues that can cause practical confidentiality, integrity, or availability + impact in supported SWC usage + +## Out of Scope + +The following reports are generally out of scope: + +- Issues that depend only on using SWC as an unsandboxed public service for + arbitrary untrusted input +- Issues that affect only unsupported versions +- Reports without a practical security impact +- Known dependency vulnerabilities without a demonstrated impact on SWC From 0c80736ad2e0a5007c5e4aaae27b5e805bbb58a1 Mon Sep 17 00:00:00 2001 From: LongYinan Date: Thu, 30 Jul 2026 09:10:40 +0800 Subject: [PATCH 2/2] chore: trigger commit for PR --- SECURITY.md | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 0fd703d66..046fc2c64 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,7 +2,7 @@ ## Supported Versions -Security fixes are provided for the latest released version of SWC and the +Security fixes are provided for the latest released version of @swc-node/* packages and the `main` branch. Older releases may receive fixes at the maintainers' discretion, but they are @@ -30,36 +30,32 @@ public disclosure when appropriate. ## Security Model -SWC is a build tool. SWC does not support processing untrusted input and does -not provide isolation, resource containment, or other sandbox guarantees. It is +@swc-node/* packages are tools. They do not support processing untrusted input and do +not provide isolation, resource containment, or other sandbox guarantees. They are not designed to be a SaaS platform, a multi-tenant sandbox, or a security boundary for executing or transforming arbitrary untrusted input. This applies -regardless of the input language, syntax, file type, or SWC package used to +regardless of the input language, syntax, file type, or package used to process it. -If you operate SWC in a service that accepts input from untrusted users or -tenants, you are responsible for validating that input before passing it to SWC +If you operate @swc-node/* in a service that accepts input from untrusted users or +tenants, you are responsible for validating that input before passing it to @swc-node/* and for applying appropriate isolation, resource limits, privilege separation, and operational controls around the process. ## Scope -Security reports are in scope when they affect SWC itself, including: +Security reports are in scope when they affect the packages in this repository (@swc-node/*), including: -- Official Rust crates, in all supported usage -- Official npm packages when used as build tools, including CLI and development - server integrations -- Official bindings and release artifacts -- Parser, compiler, bundler, transform, minifier, and code generation behavior -- Issues that can cause practical confidentiality, integrity, or availability - impact in supported SWC usage +- Official @swc-node/* npm packages + +**Note:** This repository specifically maintains the `@swc-node/*` npm packages. It does NOT maintain the upstream [swc-project/swc](https://github.com/swc-project/swc) project (including its Rust crates, bindings, parser, bundler, or minifier). If you find a vulnerability in the upstream SWC project, please report it to their security channel instead. ## Out of Scope The following reports are generally out of scope: -- Issues that depend only on using SWC as an unsandboxed public service for +- Issues that depend only on using @swc-node/* as an unsandboxed public service for arbitrary untrusted input - Issues that affect only unsupported versions - Reports without a practical security impact -- Known dependency vulnerabilities without a demonstrated impact on SWC +- Known dependency vulnerabilities without a demonstrated impact on @swc-node/*