FlowConvert is a 100 %-client-side static web app. Only the latest main branch is supported with security fixes.

Please do not open a public GitHub issue for security problems.

Email security@mekkodigital.com with:

• A description of the issue and its impact (e.g., XSS via pasted HTML, clipboard hijack, prototype pollution, supply-chain).
• Reproduction steps or a minimal proof of concept.
• Any suggested fix.

We will:

1. Acknowledge receipt within 3 business days.
2. Investigate and confirm or dispute the report within 10 business days.
3. Coordinate a fix and a disclosure timeline with you. We aim to ship a patch within 30 days of confirmation.

We appreciate responsible disclosure and will credit reporters (if they wish) in the release notes once a fix is published.

In scope:

• The web app under this repository (Next.js code, conversion engine, build pipeline).
• Anything that processes user-pasted HTML/CSS/JS unsafely (XSS, code execution outside the sandbox, clipboard abuse).

Out of scope:

• Issues in third-party Webflow tooling.
• Self-XSS by pasting attacker-controlled HTML into your own browser (the app intentionally runs your pasted code through DOMParser only — no eval, no innerHTML of pasted content into the live page).
• Bugs that only manifest after the converted JSON is pasted into Webflow Designer.