If you discover a security vulnerability in ComicCaster, please report it through GitHub's private vulnerability reporting:

1. Go to the Security tab of this repository
2. Click "Report a vulnerability"
3. Provide a description of the issue, steps to reproduce, and any potential impact

Please do not open a public issue for security vulnerabilities.

• Acknowledgment: Within 48 hours of your report
• Critical fixes: Within 14 days
• Non-critical fixes: Addressed in the next regular maintenance cycle

The following are considered in scope for security reports:

• Cross-site scripting (XSS) or injection vulnerabilities in the web interface
• Credential or secret exposure in code, logs, or configuration
• Vulnerabilities in dependencies that affect ComicCaster's deployment
• Issues that could compromise the Netlify deployment or build pipeline
• Server-side request forgery (SSRF) or path traversal in serverless functions

The following are out of scope:

• The content of comic feeds (publicly available material aggregated via RSS)
• Rate limiting or availability of third-party comic source websites
• Issues that require physical access to the build machine
• Findings from automated scanners without a demonstrated impact

ComicCaster has little code exposed to the internet:

• Public: static files on Netlify (the site, the feeds, the catalog) and a handful of serverless functions in functions/. The two functions that fetch a URL on a caller's behalf accept only allowlisted targets and don't follow redirects. The feed preview fetches only ComicCaster's own feeds and the listed external feed URLs. The Far Side image proxy fetches only Far Side image hosts.
• Not public: scraping and feed generation run on a private host, in Python driving a Chrome browser, and talk only to the comic sources.
• Dependencies: the host's Python environment is pinned in constraints.txt. CI tests those exact pins, and every daily run checks the installed packages against the OSV vulnerability database. Dependabot alerts cover direct dependencies. Secret scanning blocks pushes that contain a recognized credential.

A 2026-10-24 review found that the realistic risks are logic, configuration and patching gaps (an over-broad fetch, CI not testing the deployed pins, a vulnerable indirect dependency), not memory-safety bugs in our own code. Reports in those areas are especially welcome.

Only the latest version on the main branch is actively maintained. There are no prior releases or version branches.

We follow coordinated disclosure. Once a fix is available, we'll credit the reporter (unless they prefer to remain anonymous) and publish details in the commit history.