Security Vulnerability Reporting Process

[Venukamatchi]

Hi maintainers,

I identified a potential security vulnerability affecting this project/repository and would like to report it responsibly.

Could you please let me know the preferred channel for submitting security issues privately?
I could not find a SECURITY.md file or dedicated disclosure policy.

Thank you.

[sharaddh]

1. Check for Private Vulnerability Reporting
   First, verify if the repository has Private Vulnerability Reporting (PVR) enabled:

Navigate to the repository: https://github.com/tailwindlabs/tailwindcss
Click on the Security tab.
Look for a "Report a vulnerability" button.
If visible: Click it to submit your report directly via GitHub’s secure form. This is the preferred method.

[Syaptiyan]

You can report security vulnerabilities to Tailwind CSS through GitHub Security Advisories.

How to report:

1. Go to the repository: https://github.com/tailwindlabs/tailwindcss
2. Click on "Security" tab
3. Click "Report a vulnerability"
4. Fill in the details

Alternative:

You can also email: security@tailwindcss.com

What to include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

Response time:

The Tailwind team typically responds within 48 hours for security issues.

Bug bounty:

Tailwind CSS does not currently have a bug bounty program, but they appreciate responsible disclosure.