Security: avacms/ava

Security

Report a vulnerability

SECURITY.md

Security Policy

This document outlines how security issues should be reported and how Ava CMS handles vulnerability disclosures. Ava CMS is an open-source project under active development and is not a commercial product.

Supported Versions

Ava CMS is currently under active development. Bug fixes and security improvements are released frequently. We strongly recommend that all users run the latest version of the software. To ensure the best security posture, please update your installation regularly and subscribe to release notifications. Previous versions are not maintained and won't receive security patches.

Reporting a Vulnerability

If you believe you have found a security vulnerability in Ava CMS, please disclose it privately.

Contact:
📧 ava@addy.zone

Please do not open a public GitHub issue for security-related reports.

When reporting a vulnerability, include as much detail as possible:

  • A description of the issue and its potential impact
  • Steps to reproduce the issue, if known
  • Affected versions or components
  • Any relevant logs, screenshots, or proof-of-concept code (if safe to share)

Clear and responsible reports make it much easier to understand and assess the issue.

Responsible Disclosure

Ava CMS follows a responsible disclosure approach:

  • Please allow reasonable time for the issue to be reviewed before sharing details publicly
  • Avoid exploiting the issue beyond what is necessary to demonstrate it
  • Do not access or modify data that does not belong to you

Because Ava CMS is maintained by volunteers, response times may vary. Not all reports will result in a fix, particularly if the issue depends on configuration, third-party code, or unsupported versions.

What to Expect

  • Reports will be reviewed on a best-effort basis
  • Valid issues may be fixed in a future release or documented as known limitations
  • There is no guaranteed timeline for responses or patches
  • Security fixes may be released without advance notice

Ava CMS does not currently operate a bug bounty program.

Scope & Limitations

The following are generally out of scope:

  • Vulnerabilities caused by misconfiguration
  • Issues in third-party plugins, themes, or dependencies
  • Local development environments
  • Attacks requiring full server compromise
  • Social engineering or phishing attacks

Site owners are responsible for securing their hosting environment, PHP configuration, web server, and deployment practices.

Project Status

Ava CMS is an evolving project. Security-related behaviour may change between versions, and no part of the system should be assumed to be complete, audited, or suitable for high-risk or sensitive environments without independent review.

By using Ava CMS, you acknowledge that it is provided without warranty and that you assume responsibility for evaluating its suitability for your use case.

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: avacms/ava
Security
Report a vulnerability

SECURITY.md

Security Policy
This document outlines how security issues should be reported and how Ava CMS handles vulnerability disclosures. Ava CMS is an open-source project under active development and is not a commercial product.
Supported Versions
Ava CMS is currently under active development. Bug fixes and security improvements are released frequently. We strongly recommend that all users run the latest version of the software. To ensure the best security posture, please update your installation regularly and subscribe to release notifications. Previous versions are not maintained and won't receive security patches.
Reporting a Vulnerability
If you believe you have found a security vulnerability in Ava CMS, please disclose it privately.
Contact:

📧 ava@addy.zone
Please do not open a public GitHub issue for security-related reports.
When reporting a vulnerability, include as much detail as possible:
  • A description of the issue and its potential impact
  • Steps to reproduce the issue, if known
  • Affected versions or components
  • Any relevant logs, screenshots, or proof-of-concept code (if safe to share)
Clear and responsible reports make it much easier to understand and assess the issue.
Responsible Disclosure
Ava CMS follows a responsible disclosure approach:
  • Please allow reasonable time for the issue to be reviewed before sharing details publicly
  • Avoid exploiting the issue beyond what is necessary to demonstrate it
  • Do not access or modify data that does not belong to you
Because Ava CMS is maintained by volunteers, response times may vary. Not all reports will result in a fix, particularly if the issue depends on configuration, third-party code, or unsupported versions.
What to Expect
  • Reports will be reviewed on a best-effort basis
  • Valid issues may be fixed in a future release or documented as known limitations
  • There is no guaranteed timeline for responses or patches
  • Security fixes may be released without advance notice
Ava CMS does not currently operate a bug bounty program.
Scope & Limitations
The following are generally out of scope:
  • Vulnerabilities caused by misconfiguration
  • Issues in third-party plugins, themes, or dependencies
  • Local development environments
  • Attacks requiring full server compromise
  • Social engineering or phishing attacks
Site owners are responsible for securing their hosting environment, PHP configuration, web server, and deployment practices.
Project Status
Ava CMS is an evolving project. Security-related behaviour may change between versions, and no part of the system should be assumed to be complete, audited, or suitable for high-risk or sensitive environments without independent review.
By using Ava CMS, you acknowledge that it is provided without warranty and that you assume responsibility for evaluating its suitability for your use case.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: avacms/ava
Security
Report a vulnerability

SECURITY.md

Security Policy
This document outlines how security issues should be reported and how Ava CMS handles vulnerability disclosures. Ava CMS is an open-source project under active development and is not a commercial product.
Supported Versions
Ava CMS is currently under active development. Bug fixes and security improvements are released frequently. We strongly recommend that all users run the latest version of the software. To ensure the best security posture, please update your installation regularly and subscribe to release notifications. Previous versions are not maintained and won't receive security patches.
Reporting a Vulnerability
If you believe you have found a security vulnerability in Ava CMS, please disclose it privately.
Contact:

📧 ava@addy.zone
Please do not open a public GitHub issue for security-related reports.
When reporting a vulnerability, include as much detail as possible:
  • A description of the issue and its potential impact
  • Steps to reproduce the issue, if known
  • Affected versions or components
  • Any relevant logs, screenshots, or proof-of-concept code (if safe to share)
Clear and responsible reports make it much easier to understand and assess the issue.
Responsible Disclosure
Ava CMS follows a responsible disclosure approach:
  • Please allow reasonable time for the issue to be reviewed before sharing details publicly
  • Avoid exploiting the issue beyond what is necessary to demonstrate it
  • Do not access or modify data that does not belong to you
Because Ava CMS is maintained by volunteers, response times may vary. Not all reports will result in a fix, particularly if the issue depends on configuration, third-party code, or unsupported versions.
What to Expect
  • Reports will be reviewed on a best-effort basis
  • Valid issues may be fixed in a future release or documented as known limitations
  • There is no guaranteed timeline for responses or patches
  • Security fixes may be released without advance notice
Ava CMS does not currently operate a bug bounty program.
Scope & Limitations
The following are generally out of scope:
  • Vulnerabilities caused by misconfiguration
  • Issues in third-party plugins, themes, or dependencies
  • Local development environments
  • Attacks requiring full server compromise
  • Social engineering or phishing attacks
Site owners are responsible for securing their hosting environment, PHP configuration, web server, and deployment practices.
Project Status
Ava CMS is an evolving project. Security-related behaviour may change between versions, and no part of the system should be assumed to be complete, audited, or suitable for high-risk or sensitive environments without independent review.
By using Ava CMS, you acknowledge that it is provided without warranty and that you assume responsibility for evaluating its suitability for your use case.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: avacms/ava
Security
Report a vulnerability

SECURITY.md

Security Policy
This document outlines how security issues should be reported and how Ava CMS handles vulnerability disclosures. Ava CMS is an open-source project under active development and is not a commercial product.
Supported Versions
Ava CMS is currently under active development. Bug fixes and security improvements are released frequently. We strongly recommend that all users run the latest version of the software. To ensure the best security posture, please update your installation regularly and subscribe to release notifications. Previous versions are not maintained and won't receive security patches.
Reporting a Vulnerability
If you believe you have found a security vulnerability in Ava CMS, please disclose it privately.
Contact:

📧 ava@addy.zone
Please do not open a public GitHub issue for security-related reports.
When reporting a vulnerability, include as much detail as possible:
  • A description of the issue and its potential impact
  • Steps to reproduce the issue, if known
  • Affected versions or components
  • Any relevant logs, screenshots, or proof-of-concept code (if safe to share)
Clear and responsible reports make it much easier to understand and assess the issue.
Responsible Disclosure
Ava CMS follows a responsible disclosure approach:
  • Please allow reasonable time for the issue to be reviewed before sharing details publicly
  • Avoid exploiting the issue beyond what is necessary to demonstrate it
  • Do not access or modify data that does not belong to you
Because Ava CMS is maintained by volunteers, response times may vary. Not all reports will result in a fix, particularly if the issue depends on configuration, third-party code, or unsupported versions.
What to Expect
  • Reports will be reviewed on a best-effort basis
  • Valid issues may be fixed in a future release or documented as known limitations
  • There is no guaranteed timeline for responses or patches
  • Security fixes may be released without advance notice
Ava CMS does not currently operate a bug bounty program.
Scope & Limitations
The following are generally out of scope:
  • Vulnerabilities caused by misconfiguration
  • Issues in third-party plugins, themes, or dependencies
  • Local development environments
  • Attacks requiring full server compromise
  • Social engineering or phishing attacks
Site owners are responsible for securing their hosting environment, PHP configuration, web server, and deployment practices.
Project Status
Ava CMS is an evolving project. Security-related behaviour may change between versions, and no part of the system should be assumed to be complete, audited, or suitable for high-risk or sensitive environments without independent review.
By using Ava CMS, you acknowledge that it is provided without warranty and that you assume responsibility for evaluating its suitability for your use case.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: avacms/ava
Security
Report a vulnerability

SECURITY.md

Security Policy
This document outlines how security issues should be reported and how Ava CMS handles vulnerability disclosures. Ava CMS is an open-source project under active development and is not a commercial product.
Supported Versions
Ava CMS is currently under active development. Bug fixes and security improvements are released frequently. We strongly recommend that all users run the latest version of the software. To ensure the best security posture, please update your installation regularly and subscribe to release notifications. Previous versions are not maintained and won't receive security patches.
Reporting a Vulnerability
If you believe you have found a security vulnerability in Ava CMS, please disclose it privately.
Contact:

📧 ava@addy.zone
Please do not open a public GitHub issue for security-related reports.
When reporting a vulnerability, include as much detail as possible:
  • A description of the issue and its potential impact
  • Steps to reproduce the issue, if known
  • Affected versions or components
  • Any relevant logs, screenshots, or proof-of-concept code (if safe to share)
Clear and responsible reports make it much easier to understand and assess the issue.
Responsible Disclosure
Ava CMS follows a responsible disclosure approach:
  • Please allow reasonable time for the issue to be reviewed before sharing details publicly
  • Avoid exploiting the issue beyond what is necessary to demonstrate it
  • Do not access or modify data that does not belong to you
Because Ava CMS is maintained by volunteers, response times may vary. Not all reports will result in a fix, particularly if the issue depends on configuration, third-party code, or unsupported versions.
What to Expect
  • Reports will be reviewed on a best-effort basis
  • Valid issues may be fixed in a future release or documented as known limitations
  • There is no guaranteed timeline for responses or patches
  • Security fixes may be released without advance notice
Ava CMS does not currently operate a bug bounty program.
Scope & Limitations
The following are generally out of scope:
  • Vulnerabilities caused by misconfiguration
  • Issues in third-party plugins, themes, or dependencies
  • Local development environments
  • Attacks requiring full server compromise
  • Social engineering or phishing attacks
Site owners are responsible for securing their hosting environment, PHP configuration, web server, and deployment practices.
Project Status
Ava CMS is an evolving project. Security-related behaviour may change between versions, and no part of the system should be assumed to be complete, audited, or suitable for high-risk or sensitive environments without independent review.
By using Ava CMS, you acknowledge that it is provided without warranty and that you assume responsibility for evaluating its suitability for your use case.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: avacms/ava
Security
Report a vulnerability

SECURITY.md

Security Policy
This document outlines how security issues should be reported and how Ava CMS handles vulnerability disclosures. Ava CMS is an open-source project under active development and is not a commercial product.
Supported Versions
Ava CMS is currently under active development. Bug fixes and security improvements are released frequently. We strongly recommend that all users run the latest version of the software. To ensure the best security posture, please update your installation regularly and subscribe to release notifications. Previous versions are not maintained and won't receive security patches.
Reporting a Vulnerability
If you believe you have found a security vulnerability in Ava CMS, please disclose it privately.
Contact:

📧 ava@addy.zone
Please do not open a public GitHub issue for security-related reports.
When reporting a vulnerability, include as much detail as possible:
  • A description of the issue and its potential impact
  • Steps to reproduce the issue, if known
  • Affected versions or components
  • Any relevant logs, screenshots, or proof-of-concept code (if safe to share)
Clear and responsible reports make it much easier to understand and assess the issue.
Responsible Disclosure
Ava CMS follows a responsible disclosure approach:
  • Please allow reasonable time for the issue to be reviewed before sharing details publicly
  • Avoid exploiting the issue beyond what is necessary to demonstrate it
  • Do not access or modify data that does not belong to you
Because Ava CMS is maintained by volunteers, response times may vary. Not all reports will result in a fix, particularly if the issue depends on configuration, third-party code, or unsupported versions.
What to Expect
  • Reports will be reviewed on a best-effort basis
  • Valid issues may be fixed in a future release or documented as known limitations
  • There is no guaranteed timeline for responses or patches
  • Security fixes may be released without advance notice
Ava CMS does not currently operate a bug bounty program.
Scope & Limitations
The following are generally out of scope:
  • Vulnerabilities caused by misconfiguration
  • Issues in third-party plugins, themes, or dependencies
  • Local development environments
  • Attacks requiring full server compromise
  • Social engineering or phishing attacks
Site owners are responsible for securing their hosting environment, PHP configuration, web server, and deployment practices.
Project Status
Ava CMS is an evolving project. Security-related behaviour may change between versions, and no part of the system should be assumed to be complete, audited, or suitable for high-risk or sensitive environments without independent review.
By using Ava CMS, you acknowledge that it is provided without warranty and that you assume responsibility for evaluating its suitability for your use case.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: avacms/ava
Security
Report a vulnerability

SECURITY.md

Security Policy
This document outlines how security issues should be reported and how Ava CMS handles vulnerability disclosures. Ava CMS is an open-source project under active development and is not a commercial product.
Supported Versions
Ava CMS is currently under active development. Bug fixes and security improvements are released frequently. We strongly recommend that all users run the latest version of the software. To ensure the best security posture, please update your installation regularly and subscribe to release notifications. Previous versions are not maintained and won't receive security patches.
Reporting a Vulnerability
If you believe you have found a security vulnerability in Ava CMS, please disclose it privately.
Contact:

📧 ava@addy.zone
Please do not open a public GitHub issue for security-related reports.
When reporting a vulnerability, include as much detail as possible:
  • A description of the issue and its potential impact
  • Steps to reproduce the issue, if known
  • Affected versions or components
  • Any relevant logs, screenshots, or proof-of-concept code (if safe to share)
Clear and responsible reports make it much easier to understand and assess the issue.
Responsible Disclosure
Ava CMS follows a responsible disclosure approach:
  • Please allow reasonable time for the issue to be reviewed before sharing details publicly
  • Avoid exploiting the issue beyond what is necessary to demonstrate it
  • Do not access or modify data that does not belong to you
Because Ava CMS is maintained by volunteers, response times may vary. Not all reports will result in a fix, particularly if the issue depends on configuration, third-party code, or unsupported versions.
What to Expect
  • Reports will be reviewed on a best-effort basis
  • Valid issues may be fixed in a future release or documented as known limitations
  • There is no guaranteed timeline for responses or patches
  • Security fixes may be released without advance notice
Ava CMS does not currently operate a bug bounty program.
Scope & Limitations
The following are generally out of scope:
  • Vulnerabilities caused by misconfiguration
  • Issues in third-party plugins, themes, or dependencies
  • Local development environments
  • Attacks requiring full server compromise
  • Social engineering or phishing attacks
Site owners are responsible for securing their hosting environment, PHP configuration, web server, and deployment practices.
Project Status
Ava CMS is an evolving project. Security-related behaviour may change between versions, and no part of the system should be assumed to be complete, audited, or suitable for high-risk or sensitive environments without independent review.
By using Ava CMS, you acknowledge that it is provided without warranty and that you assume responsibility for evaluating its suitability for your use case.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: avacms/ava
Security
Report a vulnerability

SECURITY.md

Security Policy
This document outlines how security issues should be reported and how Ava CMS handles vulnerability disclosures. Ava CMS is an open-source project under active development and is not a commercial product.
Supported Versions
Ava CMS is currently under active development. Bug fixes and security improvements are released frequently. We strongly recommend that all users run the latest version of the software. To ensure the best security posture, please update your installation regularly and subscribe to release notifications. Previous versions are not maintained and won't receive security patches.
Reporting a Vulnerability
If you believe you have found a security vulnerability in Ava CMS, please disclose it privately.
Contact:

📧 ava@addy.zone
Please do not open a public GitHub issue for security-related reports.
When reporting a vulnerability, include as much detail as possible:
  • A description of the issue and its potential impact
  • Steps to reproduce the issue, if known
  • Affected versions or components
  • Any relevant logs, screenshots, or proof-of-concept code (if safe to share)
Clear and responsible reports make it much easier to understand and assess the issue.
Responsible Disclosure
Ava CMS follows a responsible disclosure approach:
  • Please allow reasonable time for the issue to be reviewed before sharing details publicly
  • Avoid exploiting the issue beyond what is necessary to demonstrate it
  • Do not access or modify data that does not belong to you
Because Ava CMS is maintained by volunteers, response times may vary. Not all reports will result in a fix, particularly if the issue depends on configuration, third-party code, or unsupported versions.
What to Expect
  • Reports will be reviewed on a best-effort basis
  • Valid issues may be fixed in a future release or documented as known limitations
  • There is no guaranteed timeline for responses or patches
  • Security fixes may be released without advance notice
Ava CMS does not currently operate a bug bounty program.
Scope & Limitations
The following are generally out of scope:
  • Vulnerabilities caused by misconfiguration
  • Issues in third-party plugins, themes, or dependencies
  • Local development environments
  • Attacks requiring full server compromise
  • Social engineering or phishing attacks
Site owners are responsible for securing their hosting environment, PHP configuration, web server, and deployment practices.
Project Status
Ava CMS is an evolving project. Security-related behaviour may change between versions, and no part of the system should be assumed to be complete, audited, or suitable for high-risk or sensitive environments without independent review.
By using Ava CMS, you acknowledge that it is provided without warranty and that you assume responsibility for evaluating its suitability for your use case.
 There aren't any published security advisories