We prioritize our project’s security and encourage the community to responsibly report any vulnerabilities.
We take the security of our Syncfusion Blazor Toolkit project very seriously. If you discover a security vulnerability, please report it responsibly using the steps outlined below.
- Please email us at security@syncfusion.com with a detailed report of the vulnerability.
- Wait until we verify that the problem has been fixed before making the announcement in public.
- Provide instructions on how to replicate the vulnerability.
- Share any possible impact or exploitation scenarios.
- We will acknowledge receipt of your report within 2 business days.
- You will receive updates on the progress as we investigate and resolve the issue.
Once a vulnerability is verified, it is classified by severity. The following SLAs apply from the date of verification:
| Severity | Definition | Target remediation |
|---|---|---|
| Critical | Remote code execution, complete authentication bypass, or data exfiltration | ≤ 7 days |
| High | Significant privilege escalation, persistent XSS, or supply-chain compromise | ≤ 30 days |
| Medium | Limited-scope XSS, information disclosure, or denial of service | ≤ 90 days |
| Low | Hardening improvements or defence-in-depth gaps with no direct exploitability | Next planned release |
After a vulnerability is reported and verified:
- We will assess its severity and assign a classification from the table above.
- A fix will be developed and tested internally against the applicable SLA target.
The resolution will be included in the next available release. For Critical or High findings, an out-of-band security patch will be issued immediately.
Affected users will be notified in the GitHub repository's Releases page and other relevant channels.
On a monthly cadence (targeting the second Wednesday of each month), the maintainers will:
- Run
dotnet list package --vulnerableagainst all projects and review any flagged advisories. - Review and apply dependency updates (NuGet and npm) with a focus on security-relevant changes.
- Triage any open security issues or disclosures received since the last cycle.
- Produce a patch release if Critical or High findings are present; bundle Medium and Low fixes into the next minor release.
This project maintains a current security reference in the repository's THREAT-MODEL.md document. The project team has reviewed the current architecture, package surface, and release flow and has documented the principal risks and mitigations in good faith.
This attestation reflects the project’s current understanding as of 2026-08-12 and is intended to be updated as the toolkit evolves.