# Security

## Reporting a vulnerability

**Do not open a public issue.** Report privately, either through GitHub's
*Security → Report a vulnerability* (Private Vulnerability Reporting) on this
repository, or by email to the address in `package.json#author`.

Please include the component or subpath, the version, and the smallest
reproduction you can manage. You will get an acknowledgement; if the report is
valid, a fixed version and a note in `CHANGELOG.md` follow.

> Replace this section with your team's real contact and response times before
> publishing. A security policy nobody can act on is worse than none, because it
> implies a channel that does not exist.

## What this package is, from a security point of view

A UI component library. It renders markup in the consumer's application; it
opens no sockets, reads no files, and has no server component of its own.

Two properties matter more than usual here:

**`dependencies` is empty, and that hides things from your scanner.** Radix UI
is compiled into `dist` by the bundler and `tailwind-merge` is vendored as
source under `src/lib/tw-merge/`. Both are genuinely present in the code you
install — they just do not appear in your lock file, so `npm audit`,
Dependabot and every other downstream scanner will report this package as
having no dependencies no matter how old the code inside is.

That is a real gap and it is covered on our side, not yours:
`npm run audit:shipped` resolves the inlined tree and reports only advisories
that actually reach a consumer. It runs in CI and is a hard gate in
`npm run release`. If you are auditing this package yourself, that script is the
thing to run — the empty `dependencies` field is not evidence of anything.

**`dangerouslySetInnerHTML` is not used in shipped code.** Component content is
whatever you pass as children; the kit never interprets it as markup.

## Consuming safely

- Pin or range the version the way you would any dependency, and read
  `README.md` §9 before a major — breaking changes are documented prop by prop.
- The published tarball contains `dist`, `README.md`, `CHANGELOG.md` and
  `NOTICE` and nothing else. If you see anything else in it, that is worth
  reporting.
- `NOTICE` lists the licences of everything compiled or vendored in. Inlining is
  redistribution, so that file is part of the terms, not a courtesy.

## Supported versions

Only the latest published major receives fixes unless stated otherwise in
`CHANGELOG.md`.