Security Policies

1. Reporting Vulnerabilities

Security is a top priority for InertJS. If you discover a vulnerability, please DO NOT open a public issue on GitHub. Instead, email us securely at [email protected].

We will respond within 48 hours and work with you to patch the vulnerability before public disclosure.

2. Built-in Protections

InertJS comes with multiple security layers by default, including:

• DOM Obfuscation: Encrypted dynamic IDs and classes to prevent scraping.
• Vault Secrets: Zero-trust, encrypted .env replacement for environment variables.
• XSS Protection: Vector engine automatically escapes all injected strings.

3. Audits

We regularly audit our codebase and dependencies for known CVEs. However, as an open-source project, we rely on community peer-review to maintain a high standard of security.