Currently, only the latest major release of Music Blocks is actively supported with security updates.

Please do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability within Music Blocks (such as a WebAudio graph poisoning vector or XSS payload), please report it privately to the core maintainers. You can send an email to the Sugar Labs maintainer (walter@sugarlabs.org) with the subject "Music Blocks Security Vulnerability".

Alternatively, you can use the GitHub Security Advisories private reporting feature via the "Security" tab.

Please include the following in your report:

• A description of the vulnerability and its impact.
• Steps to reproduce the vulnerability (including browser version and OS).
• Any potential fix or mitigation if you have one.

We will acknowledge your report within 48 hours and work with you to understand the issue, develop a patch, and release it as quickly as possible. We value the efforts of security researchers and our community in helping keep Music Blocks safe!