OpenCanva is pre-1.0; security fixes land on the latest 0.1.x release of @opencanva/core.

Please report security issues privately — do not open a public issue for a vulnerability.

Use GitHub's private vulnerability reporting (the Report a vulnerability button on the repository's Security tab). We aim to acknowledge reports within a few days and will coordinate a fix and disclosure with you.

OpenCanva is a local, dev-time authoring tool, not a deployed service — that shapes what's in scope:

• opencanva dev exposes write endpoints under /__ox/* that mutate files on the developer's machine (the click-to-source inspector, asset upload/rename, design / board / token edits). These exist only in the dev server (apply: 'serve') — they are not part of opencanva build or the production bundle.
• Those endpoints are guarded: they require a same-origin request plus a custom write header (or a JSON content-type for the inspector API), so an arbitrary third-party page can't drive them cross-origin. They're meant to be reached only by the OpenCanva app itself, on localhost.

In scope — please report:

• Path traversal, missing/weak write-guards, or unvalidated input written to disk via any /__ox/* endpoint.
• Issues in @opencanva/core (runtime, Vite plugins, CLI, inspector write-back, asset handling) that let a same-origin page or a malicious design escalate beyond the intended dev-tool surface.
• The opencanva init scaffolder or a vendored skill shipping something unsafe.

Out of scope — generally:

• Third-party dependencies — report those upstream (we'll bump once fixed).
• A user's own design code (designs are arbitrary React you author and run locally).

When in doubt, report it — we'd rather triage a non-issue than miss a real one.

• esbuild dev-server file read on Windows (GHSA-g7r4-m6w7-qqqr) — surfaced transitively by npm audit via Vite's pinned esbuild. It is low severity, Windows-only, and dev-server-only, and it concerns esbuild's own serve mode, which Vite does not use. The patched esbuild is outside Vite 7's declared range, so there is no clean in-range bump yet. Per the out-of-scope policy above we'll inherit the fix when Vite widens its esbuild range. This sits squarely within the "local, dev-time tool on localhost" threat model.