Skip to content

Security: fjahn/cms

Security

SECURITY.md

If you discover a security vulnerability in Statamic, please review the following guidelines before submitting a report. We take security very seriously, and we do our best to resolve security issues as quickly as possible.

Guidelines

While working to identify potential security vulnerabilities in Statamic, we ask that you:

  • Privately share any issues that you discover with us via statamic.com/support as soon as possible.
  • Give us a reasonable amount of time to address any reported issues before publicizing them.
  • Only report issues that are in scope.
  • Provide a quality report with precise explanations and concrete attack scenarios.

Scope

We are only interested in vulnerabilities that affect Statamic itself, tested against your own local installation of the software, running the latest version. You can install a local copy of Statamic by following these installation instructions. Do not test against any Statamic installation that you don’t own, including statamic.com or statamic.dev.

Qualifying Vulnerabilities

Non-Qualifying Vulnerabilities

  • Reports from automated tools or scanners
  • Theoretical attacks without actual proof of exploitability
  • Attacks that can be guarded against by following our security recommendations.
  • Server configuration issues outside of Statamic’s control
  • Denial of Service attacks
  • Brute force attacks (e.g. on password or
  • Username or email address enumeration
  • Social engineering of Wilderborn staff or users of Statamic installations
  • Physical attacks against Statamic installations
  • Attacks involving physical access to a user’s device, or involving a device or network that is already seriously compromised (e.g. man-in-the-middle attacks)
  • Attacks that are the result of a 3rd party Statamic addon should be reported to the addon’s author
  • Attacks that are the result of a 3rd party library should be reported to the library maintainers
  • Bugs that rely on an unlikely user interaction (i.e. the user effectively attacking themselves)
  • Disclosure of tools or libraries used by Statamic and/or their versions
  • Issues that are the result of a user doing something silly (like sharing their password publicly)
  • Missing security headers which do not lead directly to a vulnerability via proof of concept
  • Vulnerabilities affecting users of outdated/unsupported browsers or platforms
  • Vulnerabilities affecting outdated versions of Statamic
  • Any behavior that is clearly documented.
  • Issues discovered while scanning a site you don’t own without permission
  • Missing CSRF tokens on forms (unless you have a proof of concept, many forms either don't need CSRF or are mitigated in other ways) and "logout" CSRF attacks
  • Open redirects

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Overview · fjahn/cms · GitHub
Skip to content
Security: fjahn/cms
Security

SECURITY.md

If you discover a security vulnerability in Statamic, please review the following guidelines before submitting a report. We take security very seriously, and we do our best to resolve security issues as quickly as possible.
Guidelines
While working to identify potential security vulnerabilities in Statamic, we ask that you:
  • Privately share any issues that you discover with us via statamic.com/support as soon as possible.
  • Give us a reasonable amount of time to address any reported issues before publicizing them.
  • Only report issues that are in scope.
  • Provide a quality report with precise explanations and concrete attack scenarios.
Scope
We are only interested in vulnerabilities that affect Statamic itself, tested against your own local installation of the software, running the latest version. You can install a local copy of Statamic by following these installation instructions. Do not test against any Statamic installation that you don’t own, including statamic.com or statamic.dev.
Qualifying Vulnerabilities
Non-Qualifying Vulnerabilities
  • Reports from automated tools or scanners
  • Theoretical attacks without actual proof of exploitability
  • Attacks that can be guarded against by following our security recommendations.
  • Server configuration issues outside of Statamic’s control
  • Denial of Service attacks
  • Brute force attacks (e.g. on password or
  • Username or email address enumeration
  • Social engineering of Wilderborn staff or users of Statamic installations
  • Physical attacks against Statamic installations
  • Attacks involving physical access to a user’s device, or involving a device or network that is already seriously compromised (e.g. man-in-the-middle attacks)
  • Attacks that are the result of a 3rd party Statamic addon should be reported to the addon’s author
  • Attacks that are the result of a 3rd party library should be reported to the library maintainers
  • Bugs that rely on an unlikely user interaction (i.e. the user effectively attacking themselves)
  • Disclosure of tools or libraries used by Statamic and/or their versions
  • Issues that are the result of a user doing something silly (like sharing their password publicly)
  • Missing security headers which do not lead directly to a vulnerability via proof of concept
  • Vulnerabilities affecting users of outdated/unsupported browsers or platforms
  • Vulnerabilities affecting outdated versions of Statamic
  • Any behavior that is clearly documented.
  • Issues discovered while scanning a site you don’t own without permission
  • Missing CSRF tokens on forms (unless you have a proof of concept, many forms either don't need CSRF or are mitigated in other ways) and "logout" CSRF attacks
  • Open redirects
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Overview · fjahn/cms · GitHub
Skip to content
Security: fjahn/cms
Security

SECURITY.md

If you discover a security vulnerability in Statamic, please review the following guidelines before submitting a report. We take security very seriously, and we do our best to resolve security issues as quickly as possible.
Guidelines
While working to identify potential security vulnerabilities in Statamic, we ask that you:
  • Privately share any issues that you discover with us via statamic.com/support as soon as possible.
  • Give us a reasonable amount of time to address any reported issues before publicizing them.
  • Only report issues that are in scope.
  • Provide a quality report with precise explanations and concrete attack scenarios.
Scope
We are only interested in vulnerabilities that affect Statamic itself, tested against your own local installation of the software, running the latest version. You can install a local copy of Statamic by following these installation instructions. Do not test against any Statamic installation that you don’t own, including statamic.com or statamic.dev.
Qualifying Vulnerabilities
Non-Qualifying Vulnerabilities
  • Reports from automated tools or scanners
  • Theoretical attacks without actual proof of exploitability
  • Attacks that can be guarded against by following our security recommendations.
  • Server configuration issues outside of Statamic’s control
  • Denial of Service attacks
  • Brute force attacks (e.g. on password or
  • Username or email address enumeration
  • Social engineering of Wilderborn staff or users of Statamic installations
  • Physical attacks against Statamic installations
  • Attacks involving physical access to a user’s device, or involving a device or network that is already seriously compromised (e.g. man-in-the-middle attacks)
  • Attacks that are the result of a 3rd party Statamic addon should be reported to the addon’s author
  • Attacks that are the result of a 3rd party library should be reported to the library maintainers
  • Bugs that rely on an unlikely user interaction (i.e. the user effectively attacking themselves)
  • Disclosure of tools or libraries used by Statamic and/or their versions
  • Issues that are the result of a user doing something silly (like sharing their password publicly)
  • Missing security headers which do not lead directly to a vulnerability via proof of concept
  • Vulnerabilities affecting users of outdated/unsupported browsers or platforms
  • Vulnerabilities affecting outdated versions of Statamic
  • Any behavior that is clearly documented.
  • Issues discovered while scanning a site you don’t own without permission
  • Missing CSRF tokens on forms (unless you have a proof of concept, many forms either don't need CSRF or are mitigated in other ways) and "logout" CSRF attacks
  • Open redirects
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Overview · fjahn/cms · GitHub
Skip to content
Security: fjahn/cms
Security

SECURITY.md

If you discover a security vulnerability in Statamic, please review the following guidelines before submitting a report. We take security very seriously, and we do our best to resolve security issues as quickly as possible.
Guidelines
While working to identify potential security vulnerabilities in Statamic, we ask that you:
  • Privately share any issues that you discover with us via statamic.com/support as soon as possible.
  • Give us a reasonable amount of time to address any reported issues before publicizing them.
  • Only report issues that are in scope.
  • Provide a quality report with precise explanations and concrete attack scenarios.
Scope
We are only interested in vulnerabilities that affect Statamic itself, tested against your own local installation of the software, running the latest version. You can install a local copy of Statamic by following these installation instructions. Do not test against any Statamic installation that you don’t own, including statamic.com or statamic.dev.
Qualifying Vulnerabilities
Non-Qualifying Vulnerabilities
  • Reports from automated tools or scanners
  • Theoretical attacks without actual proof of exploitability
  • Attacks that can be guarded against by following our security recommendations.
  • Server configuration issues outside of Statamic’s control
  • Denial of Service attacks
  • Brute force attacks (e.g. on password or
  • Username or email address enumeration
  • Social engineering of Wilderborn staff or users of Statamic installations
  • Physical attacks against Statamic installations
  • Attacks involving physical access to a user’s device, or involving a device or network that is already seriously compromised (e.g. man-in-the-middle attacks)
  • Attacks that are the result of a 3rd party Statamic addon should be reported to the addon’s author
  • Attacks that are the result of a 3rd party library should be reported to the library maintainers
  • Bugs that rely on an unlikely user interaction (i.e. the user effectively attacking themselves)
  • Disclosure of tools or libraries used by Statamic and/or their versions
  • Issues that are the result of a user doing something silly (like sharing their password publicly)
  • Missing security headers which do not lead directly to a vulnerability via proof of concept
  • Vulnerabilities affecting users of outdated/unsupported browsers or platforms
  • Vulnerabilities affecting outdated versions of Statamic
  • Any behavior that is clearly documented.
  • Issues discovered while scanning a site you don’t own without permission
  • Missing CSRF tokens on forms (unless you have a proof of concept, many forms either don't need CSRF or are mitigated in other ways) and "logout" CSRF attacks
  • Open redirects
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
Overview · fjahn/cms · GitHub
Skip to content
Security: fjahn/cms
Security

SECURITY.md

If you discover a security vulnerability in Statamic, please review the following guidelines before submitting a report. We take security very seriously, and we do our best to resolve security issues as quickly as possible.
Guidelines
While working to identify potential security vulnerabilities in Statamic, we ask that you:
  • Privately share any issues that you discover with us via statamic.com/support as soon as possible.
  • Give us a reasonable amount of time to address any reported issues before publicizing them.
  • Only report issues that are in scope.
  • Provide a quality report with precise explanations and concrete attack scenarios.
Scope
We are only interested in vulnerabilities that affect Statamic itself, tested against your own local installation of the software, running the latest version. You can install a local copy of Statamic by following these installation instructions. Do not test against any Statamic installation that you don’t own, including statamic.com or statamic.dev.
Qualifying Vulnerabilities
Non-Qualifying Vulnerabilities
  • Reports from automated tools or scanners
  • Theoretical attacks without actual proof of exploitability
  • Attacks that can be guarded against by following our security recommendations.
  • Server configuration issues outside of Statamic’s control
  • Denial of Service attacks
  • Brute force attacks (e.g. on password or
  • Username or email address enumeration
  • Social engineering of Wilderborn staff or users of Statamic installations
  • Physical attacks against Statamic installations
  • Attacks involving physical access to a user’s device, or involving a device or network that is already seriously compromised (e.g. man-in-the-middle attacks)
  • Attacks that are the result of a 3rd party Statamic addon should be reported to the addon’s author
  • Attacks that are the result of a 3rd party library should be reported to the library maintainers
  • Bugs that rely on an unlikely user interaction (i.e. the user effectively attacking themselves)
  • Disclosure of tools or libraries used by Statamic and/or their versions
  • Issues that are the result of a user doing something silly (like sharing their password publicly)
  • Missing security headers which do not lead directly to a vulnerability via proof of concept
  • Vulnerabilities affecting users of outdated/unsupported browsers or platforms
  • Vulnerabilities affecting outdated versions of Statamic
  • Any behavior that is clearly documented.
  • Issues discovered while scanning a site you don’t own without permission
  • Missing CSRF tokens on forms (unless you have a proof of concept, many forms either don't need CSRF or are mitigated in other ways) and "logout" CSRF attacks
  • Open redirects
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Overview · fjahn/cms · GitHub
Skip to content
Security: fjahn/cms
Security

SECURITY.md

If you discover a security vulnerability in Statamic, please review the following guidelines before submitting a report. We take security very seriously, and we do our best to resolve security issues as quickly as possible.
Guidelines
While working to identify potential security vulnerabilities in Statamic, we ask that you:
  • Privately share any issues that you discover with us via statamic.com/support as soon as possible.
  • Give us a reasonable amount of time to address any reported issues before publicizing them.
  • Only report issues that are in scope.
  • Provide a quality report with precise explanations and concrete attack scenarios.
Scope
We are only interested in vulnerabilities that affect Statamic itself, tested against your own local installation of the software, running the latest version. You can install a local copy of Statamic by following these installation instructions. Do not test against any Statamic installation that you don’t own, including statamic.com or statamic.dev.
Qualifying Vulnerabilities
Non-Qualifying Vulnerabilities
  • Reports from automated tools or scanners
  • Theoretical attacks without actual proof of exploitability
  • Attacks that can be guarded against by following our security recommendations.
  • Server configuration issues outside of Statamic’s control
  • Denial of Service attacks
  • Brute force attacks (e.g. on password or
  • Username or email address enumeration
  • Social engineering of Wilderborn staff or users of Statamic installations
  • Physical attacks against Statamic installations
  • Attacks involving physical access to a user’s device, or involving a device or network that is already seriously compromised (e.g. man-in-the-middle attacks)
  • Attacks that are the result of a 3rd party Statamic addon should be reported to the addon’s author
  • Attacks that are the result of a 3rd party library should be reported to the library maintainers
  • Bugs that rely on an unlikely user interaction (i.e. the user effectively attacking themselves)
  • Disclosure of tools or libraries used by Statamic and/or their versions
  • Issues that are the result of a user doing something silly (like sharing their password publicly)
  • Missing security headers which do not lead directly to a vulnerability via proof of concept
  • Vulnerabilities affecting users of outdated/unsupported browsers or platforms
  • Vulnerabilities affecting outdated versions of Statamic
  • Any behavior that is clearly documented.
  • Issues discovered while scanning a site you don’t own without permission
  • Missing CSRF tokens on forms (unless you have a proof of concept, many forms either don't need CSRF or are mitigated in other ways) and "logout" CSRF attacks
  • Open redirects
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Overview · fjahn/cms · GitHub
Skip to content
Security: fjahn/cms
Security

SECURITY.md

If you discover a security vulnerability in Statamic, please review the following guidelines before submitting a report. We take security very seriously, and we do our best to resolve security issues as quickly as possible.
Guidelines
While working to identify potential security vulnerabilities in Statamic, we ask that you:
  • Privately share any issues that you discover with us via statamic.com/support as soon as possible.
  • Give us a reasonable amount of time to address any reported issues before publicizing them.
  • Only report issues that are in scope.
  • Provide a quality report with precise explanations and concrete attack scenarios.
Scope
We are only interested in vulnerabilities that affect Statamic itself, tested against your own local installation of the software, running the latest version. You can install a local copy of Statamic by following these installation instructions. Do not test against any Statamic installation that you don’t own, including statamic.com or statamic.dev.
Qualifying Vulnerabilities
Non-Qualifying Vulnerabilities
  • Reports from automated tools or scanners
  • Theoretical attacks without actual proof of exploitability
  • Attacks that can be guarded against by following our security recommendations.
  • Server configuration issues outside of Statamic’s control
  • Denial of Service attacks
  • Brute force attacks (e.g. on password or
  • Username or email address enumeration
  • Social engineering of Wilderborn staff or users of Statamic installations
  • Physical attacks against Statamic installations
  • Attacks involving physical access to a user’s device, or involving a device or network that is already seriously compromised (e.g. man-in-the-middle attacks)
  • Attacks that are the result of a 3rd party Statamic addon should be reported to the addon’s author
  • Attacks that are the result of a 3rd party library should be reported to the library maintainers
  • Bugs that rely on an unlikely user interaction (i.e. the user effectively attacking themselves)
  • Disclosure of tools or libraries used by Statamic and/or their versions
  • Issues that are the result of a user doing something silly (like sharing their password publicly)
  • Missing security headers which do not lead directly to a vulnerability via proof of concept
  • Vulnerabilities affecting users of outdated/unsupported browsers or platforms
  • Vulnerabilities affecting outdated versions of Statamic
  • Any behavior that is clearly documented.
  • Issues discovered while scanning a site you don’t own without permission
  • Missing CSRF tokens on forms (unless you have a proof of concept, many forms either don't need CSRF or are mitigated in other ways) and "logout" CSRF attacks
  • Open redirects
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
Overview · fjahn/cms · GitHub
Skip to content
Security: fjahn/cms
Security

SECURITY.md

If you discover a security vulnerability in Statamic, please review the following guidelines before submitting a report. We take security very seriously, and we do our best to resolve security issues as quickly as possible.
Guidelines
While working to identify potential security vulnerabilities in Statamic, we ask that you:
  • Privately share any issues that you discover with us via statamic.com/support as soon as possible.
  • Give us a reasonable amount of time to address any reported issues before publicizing them.
  • Only report issues that are in scope.
  • Provide a quality report with precise explanations and concrete attack scenarios.
Scope
We are only interested in vulnerabilities that affect Statamic itself, tested against your own local installation of the software, running the latest version. You can install a local copy of Statamic by following these installation instructions. Do not test against any Statamic installation that you don’t own, including statamic.com or statamic.dev.
Qualifying Vulnerabilities
Non-Qualifying Vulnerabilities
  • Reports from automated tools or scanners
  • Theoretical attacks without actual proof of exploitability
  • Attacks that can be guarded against by following our security recommendations.
  • Server configuration issues outside of Statamic’s control
  • Denial of Service attacks
  • Brute force attacks (e.g. on password or
  • Username or email address enumeration
  • Social engineering of Wilderborn staff or users of Statamic installations
  • Physical attacks against Statamic installations
  • Attacks involving physical access to a user’s device, or involving a device or network that is already seriously compromised (e.g. man-in-the-middle attacks)
  • Attacks that are the result of a 3rd party Statamic addon should be reported to the addon’s author
  • Attacks that are the result of a 3rd party library should be reported to the library maintainers
  • Bugs that rely on an unlikely user interaction (i.e. the user effectively attacking themselves)
  • Disclosure of tools or libraries used by Statamic and/or their versions
  • Issues that are the result of a user doing something silly (like sharing their password publicly)
  • Missing security headers which do not lead directly to a vulnerability via proof of concept
  • Vulnerabilities affecting users of outdated/unsupported browsers or platforms
  • Vulnerabilities affecting outdated versions of Statamic
  • Any behavior that is clearly documented.
  • Issues discovered while scanning a site you don’t own without permission
  • Missing CSRF tokens on forms (unless you have a proof of concept, many forms either don't need CSRF or are mitigated in other ways) and "logout" CSRF attacks
  • Open redirects
 There aren't any published security advisories