We actively maintain and provide security updates for the following versions:

• Content Security Policy (CSP) support
• Subresource Integrity (SRI) for external resources
• XSS protection through Hugo's built-in escaping
• Safe HTML rendering with configurable markup
• Secure defaults for all theme configurations

1. Keep Hugo Updated: Always use the latest stable Hugo version
2. Regular Updates: Update the theme regularly to get security patches
3. Content Validation: Validate user-generated content before publishing
4. HTTPS Only: Always deploy sites with HTTPS enabled

• External CDN resources should be reviewed before enabling
• User-generated content requires proper sanitization
• Third-party integrations (comments, analytics) should be configured securely

We take security seriously and appreciate your help in keeping FixIt secure.

1. Create an Issue: Report vulnerabilities at https://github.com/hugo-fixit/FixIt/issues
2. Private Disclosure: For sensitive security issues, email the maintainers directly
3. Include Details: Provide clear steps to reproduce the vulnerability

• Description: Clear description of the vulnerability
• Impact: Potential impact and severity
• Reproduction: Step-by-step instructions to reproduce
• Environment: Hugo version, theme version, and platform details
• Solution: Suggested fix if you have one

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 1 week
• Status Updates: Weekly updates on progress
• Resolution: Security fixes are prioritized and released as soon as possible

• We follow responsible disclosure practices
• We will coordinate with you on the disclosure timeline

• Hugo Security Model
• OWASP Web Security Testing Guide
• Content Security Policy