Security fixes target the latest published 0.x release until the gem reaches 1.0.

Please report security issues privately through the repository security advisory flow when available. If advisories are not enabled, contact the repository owner directly before opening a public issue.

Include:

• affected version;
• reproduction steps;
• expected and actual behavior;
• whether untrusted user input is involved.

Markdown Composer is a headless composition engine. Host applications are responsible for source access, authorization, tenant/user policy, sanitization profiles, asset rules, and deciding which advanced controls are available to untrusted users.

The gem validates portable Composer configuration through MarkdownComposer.validate. Frameworks such as Rails can add a second validation layer for application-specific policy.

Regex predicates and regex text replacement are available for trusted authoring workflows. If configs are accepted from untrusted users, gate those controls in the host UI or adapter policy before execution.