If you discover a security vulnerability in SimpleRSS, please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities.

Instead, use one of these channels:

• Open a GitHub private security advisory if available
• Contact the maintainer via the NuGet package owner profile

Please include:

• A description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if you have one)

You should receive a response within a reasonable timeframe. We will work with you to understand and address the issue before any public disclosure.

SimpleRSS fetches and parses untrusted XML from remote URLs. When using the library:

• Feed XML is parsed with DTD processing disabled and XML size limits applied.
• HTTP responses are limited by MaxResponseBytes before parsing.
• Use HTTPS feed URLs where possible.
• Sanitize feed HTML content before rendering it in a UI.