The Sopplayer project takes the security of our library and downstream web applications seriously. We welcome responsible disclosure from security researchers and developers.

If you discover a potential security vulnerability in Sopplayer, please do not open a public GitHub issue. Instead, please report it privately:

1. GitHub Security Advisories: Submit an advisory privately through the Sopplayer Security Advisories page.
2. Direct Email: Alternatively, email the maintainer directly at sh20raj@gmail.com with the subject line: [Security] Vulnerability in Sopplayer.

Please include in your report:

• A description of the vulnerability and potential attack scenarios.
• Step-by-step reproduction instructions or a minimal Proof of Concept (PoC).
• Affected versions and environments (browsers, Node version if applicable).

• Initial Acknowledgment: Within 48 hours.
• Assessment and Fix Plan: Within 7 days.
• Public Disclosure and Patch Release: Coordinated with the reporter after testing.

Sopplayer v2.0 implements strict security defaults:

• No Unsafe DOM Construction: We eliminate raw innerHTML concatenation with user-provided parameters, relying instead on textContent and safe DOM node creation.
• Strict Protocol Validation: Media URLs, poster images, and external links are validated to prohibit pseudo-protocols such as javascript:, vbscript:, and data:text/html.
• Safe Base64 / Query Parsing: URL parameters (e.g. in embed generators) are parsed within safe try-catch blocks and validated against strict schemas before rendering.
• Zero Third-Party Runtime Tracking: All legacy third-party tracking scripts (such as AddThis) have been removed.

When integrating Sopplayer with a Content Security Policy, the following directives are recommended:

Content-Security-Policy: default-src 'self'; media-src 'self' https: blob:; img-src 'self' data: https:; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; script-src 'self' https://cdn.jsdelivr.net;