Security
Security is handled the same way across openxml-office, tauri-remote-ui,xml_rs and future projects: GitHub's native security features watch every repository, and the Azure Pipelines build adds per-language scanning and secret detection on top.
GitHub security features
Every repository has GitHub's built-in security features enabled, so vulnerabilities are surfaced and tracked automatically — from a reported CVE in a dependency all the way to leaked malware in the supply chain.
| Feature | What it tracks |
|---|---|
| Private vulnerability reporting | A private channel for anyone to responsibly disclose a vulnerability. Reports are triaged, a fix is coordinated, and a security advisory is published once resolved. |
| Dependency graph | A complete map of the project's direct and transitive dependencies. It's the foundation the other alerts build on — nothing can be flagged unless it's known. |
| Dependabot alerts & updates | Cross-references the dependency graph against the GitHub Advisory Database and raises an alert — with an automated fix pull request — whenever a dependency has a known vulnerability. |
| Malware & supply-chain alerts | Flags dependencies pulled from malicious or compromised packages so a poisoned transitive dependency can't slip in unnoticed. |
| Secret scanning | Watches the repository for accidentally committed tokens, keys and credentials and alerts before they can be abused. |
| Code scanning | Static analysis of the source itself to catch common security bugs and insecure patterns before they ship. |
Security scanning in the pipeline
On top of GitHub's alerts, the Azure Pipelines build runs its own security stage on every pull request and merge. The scan is tailoredper language so each project's toolchain gets the checks that matter for it, and the build surfaces findings early — before a change reaches an alpha or stable channel.
- Secret scanning (git leaks). The full commit history and working tree are scanned for leaked secrets — API keys, tokens and credentials — so nothing sensitive lands in the repository.
- Dependency vulnerability scanning. Each language's dependencies are audited against known advisory databases (for example
cargo auditfor Rust and the equivalent audit tools for the other ecosystems) to catch vulnerable packages at build time. - Per-language checks. Because projects span multiple languages, the pipeline selects the appropriate scanners for each stack rather than assuming one toolchain fits all.
See the branching model for where these stages fit in the pull-request and release flow.
Reporting a vulnerability
Please don't open a public issue for a security vulnerability. Instead, email the details privately to the maintainer atcontact@draviavemal.comso it can be triaged and fixed before any public disclosure.
A useful report usually includes:
- The affected project and version (stable or alpha).
- A description of the vulnerability and its impact.
- Steps to reproduce or a minimal proof of concept.
- Any suggested fix or mitigation, if you have one.