Security: request for a private disclosure channel

[ryangravette-bsd]

Hi — thanks for QLMarkdown.

I ran a security review of the current main (a341302) and have findings I'd rather not describe publicly until you've had a chance to look at them.

The affected areas, without detail:

1. Script execution in the rendered preview from untrusted Markdown content.
2. How external link schemes are handed to the system.
3. The scope of local file inlining for images.
4. Two robustness issues in the bundled highlight library: one input that aborts the rendering process, and one that makes rendering time grow quadratically.

I have a written report with source traces and reproduction, plus a tested patch covering 1–3. I built it with Xcode 27 on macOS 27 and verified the behaviour locally, including that Mermaid and MathJax still render.

This repo doesn't have a security policy and private vulnerability reporting looks disabled. Could you either:

• enable Settings → Security → Private vulnerability reporting, and I'll file there, or
• tell me an address to send it to?

Happy to open a PR with the patch once you've seen the report.

[sbarex]

vulnerability reporting enabled

[ryangravette-bsd]

Filed privately as a security advisory, thanks for enabling it.