Security fixes target the latest commit on main.
Please report vulnerabilities privately when possible. Include:
- A short description of the issue
- Steps to reproduce (without secrets)
- Impact assessment if known
Do not include live API keys, claim tokens, or personal credentials in public issues.
- X now stores an optional here.now API key in the macOS Keychain (
com.xnow.app). - Published sites are static files hosted by here.now; report hosting-platform issues to that service when appropriate.
- User-supplied page content is HTML-escaped by
SiteRenderer; XSS regressions in rendering are in scope.