Security: raineblog/mkdocs-material

Security

Report a vulnerability

SECURITY.md

Security policy

Reporting a vulnerability

We take the security of Material for MkDocs seriously. If you believe you have found a security vulnerability in Material for MkDocs, we encourage you to report it to us responsibly.

Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Instead, please send a report to martin.donath@squidfunk.com with the following information:

  1. A description of the vulnerability and its potential impact.
  2. The steps required to reproduce the issue.
  3. Any relevant files, screenshots, or proof-of-concept code.
  4. Your name and contact information, if you would like to be credited.

Our commitment

We are committed to working with security researchers and our community to address vulnerabilities quickly and transparently. When you submit a report, you can expect the following:

  • Acknowledgement within 3 business days of your report.
  • Regular updates on our progress as we investigate and address the issue.
  • Confidentiality – we will not share your personal information without your permission, and we ask that you keep the vulnerability confidential until we have had the opportunity to address it.
  • Credit – we are happy to acknowledge your contribution once the vulnerability has been resolved, if you would like.

Supported versions

We release security fixes for the latest stable version of Material for MkDocs until its end-of-life date on November 5, 2026. We encourage all users to stay up to date with the latest release to ensure they benefit from all security patches.

After November 5, 2026, Material for MkDocs will no longer receive public security updates as part of standard maintenance.

Organizations with longer support requirements are welcome to contact us at martin.donath@squidfunk.com to discuss potential extended support options.

Scope

This policy applies to vulnerabilities in the Material for MkDocs codebase. If you discover a vulnerability in a third-party dependency, please report it to the maintainers of that project directly.

We take dependency security seriously. We are deliberate in our selection of third-party dependencies, and we actively monitor and update them to ensure Material for MkDocs remains on the latest stable versions. If you believe a dependency we use poses a security risk, feel free to bring it to our attention at martin.donath@squidfunk.com.

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: raineblog/mkdocs-material
Security
Report a vulnerability

SECURITY.md

Security policy
Reporting a vulnerability
We take the security of Material for MkDocs seriously. If you believe you have found a security vulnerability in Material for MkDocs, we encourage you to report it to us responsibly.
Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Instead, please send a report to martin.donath@squidfunk.com with the following information:
  1. A description of the vulnerability and its potential impact.
  2. The steps required to reproduce the issue.
  3. Any relevant files, screenshots, or proof-of-concept code.
  4. Your name and contact information, if you would like to be credited.
Our commitment
We are committed to working with security researchers and our community to address vulnerabilities quickly and transparently. When you submit a report, you can expect the following:
  • Acknowledgement within 3 business days of your report.
  • Regular updates on our progress as we investigate and address the issue.
  • Confidentiality – we will not share your personal information without your permission, and we ask that you keep the vulnerability confidential until we have had the opportunity to address it.
  • Credit – we are happy to acknowledge your contribution once the vulnerability has been resolved, if you would like.
Supported versions
We release security fixes for the latest stable version of Material for MkDocs until its end-of-life date on November 5, 2026. We encourage all users to stay up to date with the latest release to ensure they benefit from all security patches.
After November 5, 2026, Material for MkDocs will no longer receive public security updates as part of standard maintenance.
Organizations with longer support requirements are welcome to contact us at martin.donath@squidfunk.com to discuss potential extended support options.
Scope
This policy applies to vulnerabilities in the Material for MkDocs codebase. If you discover a vulnerability in a third-party dependency, please report it to the maintainers of that project directly.
We take dependency security seriously. We are deliberate in our selection of third-party dependencies, and we actively monitor and update them to ensure Material for MkDocs remains on the latest stable versions. If you believe a dependency we use poses a security risk, feel free to bring it to our attention at martin.donath@squidfunk.com.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: raineblog/mkdocs-material
Security
Report a vulnerability

SECURITY.md

Security policy
Reporting a vulnerability
We take the security of Material for MkDocs seriously. If you believe you have found a security vulnerability in Material for MkDocs, we encourage you to report it to us responsibly.
Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Instead, please send a report to martin.donath@squidfunk.com with the following information:
  1. A description of the vulnerability and its potential impact.
  2. The steps required to reproduce the issue.
  3. Any relevant files, screenshots, or proof-of-concept code.
  4. Your name and contact information, if you would like to be credited.
Our commitment
We are committed to working with security researchers and our community to address vulnerabilities quickly and transparently. When you submit a report, you can expect the following:
  • Acknowledgement within 3 business days of your report.
  • Regular updates on our progress as we investigate and address the issue.
  • Confidentiality – we will not share your personal information without your permission, and we ask that you keep the vulnerability confidential until we have had the opportunity to address it.
  • Credit – we are happy to acknowledge your contribution once the vulnerability has been resolved, if you would like.
Supported versions
We release security fixes for the latest stable version of Material for MkDocs until its end-of-life date on November 5, 2026. We encourage all users to stay up to date with the latest release to ensure they benefit from all security patches.
After November 5, 2026, Material for MkDocs will no longer receive public security updates as part of standard maintenance.
Organizations with longer support requirements are welcome to contact us at martin.donath@squidfunk.com to discuss potential extended support options.
Scope
This policy applies to vulnerabilities in the Material for MkDocs codebase. If you discover a vulnerability in a third-party dependency, please report it to the maintainers of that project directly.
We take dependency security seriously. We are deliberate in our selection of third-party dependencies, and we actively monitor and update them to ensure Material for MkDocs remains on the latest stable versions. If you believe a dependency we use poses a security risk, feel free to bring it to our attention at martin.donath@squidfunk.com.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: raineblog/mkdocs-material
Security
Report a vulnerability

SECURITY.md

Security policy
Reporting a vulnerability
We take the security of Material for MkDocs seriously. If you believe you have found a security vulnerability in Material for MkDocs, we encourage you to report it to us responsibly.
Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Instead, please send a report to martin.donath@squidfunk.com with the following information:
  1. A description of the vulnerability and its potential impact.
  2. The steps required to reproduce the issue.
  3. Any relevant files, screenshots, or proof-of-concept code.
  4. Your name and contact information, if you would like to be credited.
Our commitment
We are committed to working with security researchers and our community to address vulnerabilities quickly and transparently. When you submit a report, you can expect the following:
  • Acknowledgement within 3 business days of your report.
  • Regular updates on our progress as we investigate and address the issue.
  • Confidentiality – we will not share your personal information without your permission, and we ask that you keep the vulnerability confidential until we have had the opportunity to address it.
  • Credit – we are happy to acknowledge your contribution once the vulnerability has been resolved, if you would like.
Supported versions
We release security fixes for the latest stable version of Material for MkDocs until its end-of-life date on November 5, 2026. We encourage all users to stay up to date with the latest release to ensure they benefit from all security patches.
After November 5, 2026, Material for MkDocs will no longer receive public security updates as part of standard maintenance.
Organizations with longer support requirements are welcome to contact us at martin.donath@squidfunk.com to discuss potential extended support options.
Scope
This policy applies to vulnerabilities in the Material for MkDocs codebase. If you discover a vulnerability in a third-party dependency, please report it to the maintainers of that project directly.
We take dependency security seriously. We are deliberate in our selection of third-party dependencies, and we actively monitor and update them to ensure Material for MkDocs remains on the latest stable versions. If you believe a dependency we use poses a security risk, feel free to bring it to our attention at martin.donath@squidfunk.com.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: raineblog/mkdocs-material
Security
Report a vulnerability

SECURITY.md

Security policy
Reporting a vulnerability
We take the security of Material for MkDocs seriously. If you believe you have found a security vulnerability in Material for MkDocs, we encourage you to report it to us responsibly.
Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Instead, please send a report to martin.donath@squidfunk.com with the following information:
  1. A description of the vulnerability and its potential impact.
  2. The steps required to reproduce the issue.
  3. Any relevant files, screenshots, or proof-of-concept code.
  4. Your name and contact information, if you would like to be credited.
Our commitment
We are committed to working with security researchers and our community to address vulnerabilities quickly and transparently. When you submit a report, you can expect the following:
  • Acknowledgement within 3 business days of your report.
  • Regular updates on our progress as we investigate and address the issue.
  • Confidentiality – we will not share your personal information without your permission, and we ask that you keep the vulnerability confidential until we have had the opportunity to address it.
  • Credit – we are happy to acknowledge your contribution once the vulnerability has been resolved, if you would like.
Supported versions
We release security fixes for the latest stable version of Material for MkDocs until its end-of-life date on November 5, 2026. We encourage all users to stay up to date with the latest release to ensure they benefit from all security patches.
After November 5, 2026, Material for MkDocs will no longer receive public security updates as part of standard maintenance.
Organizations with longer support requirements are welcome to contact us at martin.donath@squidfunk.com to discuss potential extended support options.
Scope
This policy applies to vulnerabilities in the Material for MkDocs codebase. If you discover a vulnerability in a third-party dependency, please report it to the maintainers of that project directly.
We take dependency security seriously. We are deliberate in our selection of third-party dependencies, and we actively monitor and update them to ensure Material for MkDocs remains on the latest stable versions. If you believe a dependency we use poses a security risk, feel free to bring it to our attention at martin.donath@squidfunk.com.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: raineblog/mkdocs-material
Security
Report a vulnerability

SECURITY.md

Security policy
Reporting a vulnerability
We take the security of Material for MkDocs seriously. If you believe you have found a security vulnerability in Material for MkDocs, we encourage you to report it to us responsibly.
Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Instead, please send a report to martin.donath@squidfunk.com with the following information:
  1. A description of the vulnerability and its potential impact.
  2. The steps required to reproduce the issue.
  3. Any relevant files, screenshots, or proof-of-concept code.
  4. Your name and contact information, if you would like to be credited.
Our commitment
We are committed to working with security researchers and our community to address vulnerabilities quickly and transparently. When you submit a report, you can expect the following:
  • Acknowledgement within 3 business days of your report.
  • Regular updates on our progress as we investigate and address the issue.
  • Confidentiality – we will not share your personal information without your permission, and we ask that you keep the vulnerability confidential until we have had the opportunity to address it.
  • Credit – we are happy to acknowledge your contribution once the vulnerability has been resolved, if you would like.
Supported versions
We release security fixes for the latest stable version of Material for MkDocs until its end-of-life date on November 5, 2026. We encourage all users to stay up to date with the latest release to ensure they benefit from all security patches.
After November 5, 2026, Material for MkDocs will no longer receive public security updates as part of standard maintenance.
Organizations with longer support requirements are welcome to contact us at martin.donath@squidfunk.com to discuss potential extended support options.
Scope
This policy applies to vulnerabilities in the Material for MkDocs codebase. If you discover a vulnerability in a third-party dependency, please report it to the maintainers of that project directly.
We take dependency security seriously. We are deliberate in our selection of third-party dependencies, and we actively monitor and update them to ensure Material for MkDocs remains on the latest stable versions. If you believe a dependency we use poses a security risk, feel free to bring it to our attention at martin.donath@squidfunk.com.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: raineblog/mkdocs-material
Security
Report a vulnerability

SECURITY.md

Security policy
Reporting a vulnerability
We take the security of Material for MkDocs seriously. If you believe you have found a security vulnerability in Material for MkDocs, we encourage you to report it to us responsibly.
Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Instead, please send a report to martin.donath@squidfunk.com with the following information:
  1. A description of the vulnerability and its potential impact.
  2. The steps required to reproduce the issue.
  3. Any relevant files, screenshots, or proof-of-concept code.
  4. Your name and contact information, if you would like to be credited.
Our commitment
We are committed to working with security researchers and our community to address vulnerabilities quickly and transparently. When you submit a report, you can expect the following:
  • Acknowledgement within 3 business days of your report.
  • Regular updates on our progress as we investigate and address the issue.
  • Confidentiality – we will not share your personal information without your permission, and we ask that you keep the vulnerability confidential until we have had the opportunity to address it.
  • Credit – we are happy to acknowledge your contribution once the vulnerability has been resolved, if you would like.
Supported versions
We release security fixes for the latest stable version of Material for MkDocs until its end-of-life date on November 5, 2026. We encourage all users to stay up to date with the latest release to ensure they benefit from all security patches.
After November 5, 2026, Material for MkDocs will no longer receive public security updates as part of standard maintenance.
Organizations with longer support requirements are welcome to contact us at martin.donath@squidfunk.com to discuss potential extended support options.
Scope
This policy applies to vulnerabilities in the Material for MkDocs codebase. If you discover a vulnerability in a third-party dependency, please report it to the maintainers of that project directly.
We take dependency security seriously. We are deliberate in our selection of third-party dependencies, and we actively monitor and update them to ensure Material for MkDocs remains on the latest stable versions. If you believe a dependency we use poses a security risk, feel free to bring it to our attention at martin.donath@squidfunk.com.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: raineblog/mkdocs-material
Security
Report a vulnerability

SECURITY.md

Security policy
Reporting a vulnerability
We take the security of Material for MkDocs seriously. If you believe you have found a security vulnerability in Material for MkDocs, we encourage you to report it to us responsibly.
Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Instead, please send a report to martin.donath@squidfunk.com with the following information:
  1. A description of the vulnerability and its potential impact.
  2. The steps required to reproduce the issue.
  3. Any relevant files, screenshots, or proof-of-concept code.
  4. Your name and contact information, if you would like to be credited.
Our commitment
We are committed to working with security researchers and our community to address vulnerabilities quickly and transparently. When you submit a report, you can expect the following:
  • Acknowledgement within 3 business days of your report.
  • Regular updates on our progress as we investigate and address the issue.
  • Confidentiality – we will not share your personal information without your permission, and we ask that you keep the vulnerability confidential until we have had the opportunity to address it.
  • Credit – we are happy to acknowledge your contribution once the vulnerability has been resolved, if you would like.
Supported versions
We release security fixes for the latest stable version of Material for MkDocs until its end-of-life date on November 5, 2026. We encourage all users to stay up to date with the latest release to ensure they benefit from all security patches.
After November 5, 2026, Material for MkDocs will no longer receive public security updates as part of standard maintenance.
Organizations with longer support requirements are welcome to contact us at martin.donath@squidfunk.com to discuss potential extended support options.
Scope
This policy applies to vulnerabilities in the Material for MkDocs codebase. If you discover a vulnerability in a third-party dependency, please report it to the maintainers of that project directly.
We take dependency security seriously. We are deliberate in our selection of third-party dependencies, and we actively monitor and update them to ensure Material for MkDocs remains on the latest stable versions. If you believe a dependency we use poses a security risk, feel free to bring it to our attention at martin.donath@squidfunk.com.
 There aren't any published security advisories