# Vulnerability Disclosure Contact

**URL:** <https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390>\
**Category:** Uncategorized\
**Created:** [March 20, 2019, 3:40pm UTC](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390 "2019-03-20T15:40:30Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![EisenbergEffect](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/eisenbergeffect/32/2655_2.png) [@EisenbergEffect](https://discourse.aurelia.io/u/EisenbergEffect)\
**Post date:** [April 8, 2019, 12:35pm UTC](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390/6 "2019-04-08T12:35:40Z")

</div>

I apologize to everyone here. I forgot to follow-up on this thread.

The concern that was raised was with Aurelia’s internal HTMLSanitizer. However, per our docs, we indicate that it’s only a dev version and should not be used in production. So, there’s not really a security issue. We’ve updated our docs to add further clarity and guidance on how to replace the sanitizer with a production-grade implementation. We’ve also shipped an update that prints a warning to the console when you use our sanitizer.

---

_[View the full topic](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390)._