Please report security issues privately, not in a public issue: open a security advisory on GitHub. You will get an acknowledgement within a few days.

Please include what triggers the problem — a config, a page, a service URL or a response — and what you believe the impact is.

• The map0-viewer npm package and its bundle (everything under packages/). Of particular interest: anything that lets a config, a popup template or a response from a map service run script or escape the sanitiser — the config is data, never code, and everything rendered as HTML is sanitised (docs/09, invariants 3 and 4).
• The demo site at map0.net (site/).

Out of scope: the third-party map services the demos point at, which belong to their operators, and MapLibre GL JS itself — please report those upstream.

The latest release on npm receives fixes. There are no maintained older lines before 1.0.

A fix ships as a patch release of map0-viewer; the changelog links the advisory once it is public.