Security fixes are only applied to the latest release of the HTMLHint extension for VS Code. Please make sure you are using the most recent version from the Visual Studio Marketplace or Open VSX before reporting an issue.

Please do not report security vulnerabilities through public GitHub issues, discussions or pull requests.

Instead, report them privately using GitHub's private vulnerability reporting.

Please include as much of the following information as possible:

• A description of the vulnerability and its potential impact
• The affected extension version and VS Code version
• Steps to reproduce, including any sample HTML files or .htmlhintrc configuration
• Any suggested fix or mitigation

You can expect an acknowledgement of your report, and we will keep you informed as we work on a fix. Please allow reasonable time for a fix to be released before disclosing the issue publicly.

Vulnerabilities in the HTMLHint core library should be reported to the HTMLHint repository.