← Trust & Security

Open-source research

Security issues we found and reported upstream

Every entry here was found by the Xora engine, confirmed by a person, reported privately to the maintainer under our coordinated disclosure policy, and fixed by the people who run the project. The fixes are theirs; we list what we contributed alongside each one.

1

Fix shipped upstream

1

Project

5

In coordination, as of Oct 20, 2026

Median days from our report to the maintainer’s fix: 11.

Also reported and closed without a fix: 3 as duplicates of an earlier report; 1 the maintainer judged not to be an issue.

2026

BookStack