Security fixes are applied to the latest active release on the default branch. Older major or minor releases generally do not receive backports unless a vulnerability is highly severe, straightforward to backport, and the version remains widely used.

Please do not open public GitHub issues or pull requests for security-related reports.

To report a vulnerability privately, please use one of the following channels:

1. GitHub Security Advisories: Navigate to the Security tab of this repository and select "Report a vulnerability" (or use this link).
2. Email: Contact the maintainers listed in the README (Authors section).

Please include the following details in your report to help us triage it quickly:

• Affected Package & Entrypoint: The specific version(s) and entrypoint (e.g., tailwind-variants, /lite, /utils).
• Reproduction: A minimal, reproducible example (PoC).
• Impact: A brief assessment of what an attacker could potentially achieve.
• Suggested Fix: Any recommended remediation or code changes, if available.

We aim to acknowledge actionable reports within 7 days and provide a remediation plan or status update within 14 days.

tailwind-variants is a client/build-time class name utility. It joins and optionally merges Tailwind CSS class strings; it does not handle authentication, network requests, or direct filesystem access.

• Unexpected behavior in public APIs (tv, createTV, cn, cnMerge, cx) that could generate security-relevant, incorrect class outputs in a consuming application.
• Supply chain or published package integrity issues directly affecting official releases of this package.

• Vulnerabilities existing solely in consumer applications, frameworks, or third-party bundlers.
• Issues requiring a compromised local developer environment or malicious local dependencies outside of this repository's release pipeline.
• Social engineering reports or theoretical findings lacking a practical technical exploit.

• Zero Runtime Dependencies: The core library is built with zero third-party runtime dependencies, minimizing the potential attack surface and protecting consuming applications from transitive dependency-jacking. The tailwind-merge is an optional peer dependency, and its lifecycle/updates are managed entirely by the consuming application.
• Sanitize Untrusted Input: Treat class name strings derived from untrusted user input with care. This library does not perform HTML or CSS sanitization. Preventing XSS (Cross-Site Scripting) and style injection remains the responsibility of the host application's rendering and sanitization layers.
• Use the Lite Entrypoint: Consider using the /lite entrypoint if you do not require conflict merging. This helps minimize the dependency and execution surface of your code path.
• Keep Dependencies Current: Regularly update your project dependencies using your standard package manager workflow (e.g., pnpm lockfile updates paired with CI verification).

We prefer coordinated vulnerability disclosure. Please allow maintainers reasonable time to address and ship a fix before publishing details publicly. Credit will gladly be given to reporters who wish to be named once a patch is officially released.