@apliteni/apliteni-ui follows semver and only the latest published minor is supported with security fixes. Check the current version on npm or ui.apli.tech/changelog.

Please do not report security vulnerabilities through public GitHub issues.

Instead, report them privately using GitHub's private vulnerability reporting (Security → Report a vulnerability). It opens a private thread with the maintainers — no public disclosure until a fix is ready.

Please include:

• the affected version(s),
• a description of the issue and its impact,
• steps to reproduce or a proof of concept, and
• any suggested remediation.

We aim to acknowledge reports within a few business days and will keep you updated as we investigate. Please give us a reasonable window to release a fix before any public disclosure.

This is a framework-agnostic HTML + CSS UI kit with no runtime dependencies and no server, database, or authentication code. The ui.apli.tech site is a static build (no server code — served by static hosting). The most relevant classes of issue are supply-chain (build/publish integrity) and any XSS vector in the component string factories.