Thanks for helping make Solid safe for everyone.

Solid Community takes the security of our software seriously, including all of the open source code repositories managed through the solidjs-community GitHub organization — Solid Primitives included.

Reporting a vulnerability

If you think you've found a security issue, please do not report, discuss, or describe it on Discord or GitHub.

All security-related issues, concerns, and problems must be reported via email to security@solidjs.com.

Please include everything necessary to reproduce the problem when you send it over, including an example repository on StackBlitz or GitHub. Please don't add explicit details about the security issue you're reporting anywhere in the repository's own contents — issues, PR descriptions, commit messages, or code comments.

This is detrimental to the safety of all Solid users. No exceptions.

Embargo policy

SolidJS Community Security Team members share information only within Solid Core and other relevant internal or security-focused teams, on a need-to-know basis, to fix the related issue. Anything received through participation in that process must not be made public, shared, or even hinted at otherwise, except with prior explicit approval handled on a case-by-case basis — until the agreed-upon public disclosure date and time is reached.

As a clarifying example, this policy forbids Solid Security members from sharing list information with their employers, unless prior arrangements have been made directly with that employer.

If information leaks beyond what this policy allows, the person responsible must urgently inform the Solid Security Team of exactly what leaked, to whom, and what steps will be taken to prevent future leaks.

SolidJS Community is not directly part of the SolidJS organization, but works closely with Solid Core. Repeated policy violations may lead to removal from the Security team or the wider Solid team.