The Nokogiri Core Contributors take security very seriously and investigate all reported vulnerabilities.

If you would like to report a vulnerablity or have a security concern regarding Nokogiri or how Nokogiri is using any of its underlying platform-specific libraries (such as libxml2 or xerces), please report it via HackerOne.

Your report will be acknowledged within 24 hours, and you'll receive a more detailed response within 72 hours indicating next steps in handling your report.

PLEASE DO NOT SUBMIT REPORTS FOR THE WEBSITE NOKOGIRI.ORG. IT IS A STATIC SITE AND THERE IS NO OPPORTUNITY FOR CSRF OR XSS OR CLICKJACKING ATTACKS. ANY REPORT ABOUT THE WEBSITE WILL BE CLOSED AS NOT-APPLICABLE AND YOUR REPUTATION WILL BE REDUCED. IT WASTES YOUR TIME AND MINE SO PLEASE DO NOT DO IT.

If you have not received a reply to your submission within 48 hours, there are a few steps you can take:

• Contact the current security coordinator (Mike Dalessio <mike.dalessio@gmail.com>)

• Contact the core contributor mailing list (nokogiri-core@googlegroups.com)

• Join the nokogiri-talk group

Please note, the nokogiri-talk list is a public area. When escalating in that venue, please do not discuss your issue. Simply say that you're trying to get a hold of someone from the core team.

The information you share with the Nokogiri Core Contributors as part of this process will be kept confidential within the team, unless or until we need to share information upstream with our dependent libraries' core teams, at which point we will notify you.

If a vulnerability is first reported by you, we will credit you with the discovery in the public disclosure.