Effective date: 26 October 2026
AbsoluteUI is licensed under the AbsoluteUI Free Use License, which does not permit modification of the Software. All security fixes are therefore delivered only through official AbsoluteUI releases. This policy describes how to report vulnerabilities and which versions receive fixes.
Supported Versions
| Version | Security fixes | Bug fixes |
|---|---|---|
0.9.x (current release line, before 1.0), latest patch |
Yes | Yes |
Older 0.x minors and patches |
No. Upgrade to the latest 0.9.x. |
No |
Latest major (1.x), latest minor |
Yes | Yes |
Latest major (1.x), older minors |
No. Upgrade to the latest minor. | No |
0.9.x after 1.0 is released |
Yes, for 12 months after the 1.0 release |
No |
| Older majors | No | No |
End-of-support dates for each major version are announced at least 6 months in advance on https://aui.kasadara.com.
The current release line is 0.9. Until 1.0, security fixes ship as new 0.9.x patch releases; always use the latest one.
Reporting a Vulnerability
Do not report security vulnerabilities through public issues, discussions, or social media.
Report privately to:
- Email: security@kasadara.com
The same contact is published in /.well-known/security.txt on each AbsoluteUI website.
Include, where possible:
- affected package(s) and version(s);
- affected component(s);
- vulnerability type (for example XSS, CSP bypass, sanitizer bypass, or information exposure);
- steps to reproduce or a minimal proof of concept;
- browser(s) and version(s) used;
- impact assessment;
- any known workaround.
Do not include real personal data or production credentials in reports.
Response Process
| Stage | Target |
|---|---|
| Acknowledgement of report | Within 3 business days |
| Initial triage and severity assessment (CVSS v3.1 or later) | Within 10 business days |
| Status updates to reporter | At least every 14 days until resolution |
| Fix release: Critical/High | Target 30 days from triage |
| Fix release: Medium/Low | Next scheduled release |
Targets are objectives, not guarantees. See Section 7 of the license.
Coordinated Disclosure
- We ask reporters to keep vulnerability details confidential until a fixed release and advisory are published, or until 90 days after the report, whichever comes first, unless both parties agree otherwise.
- We will credit reporters in the advisory unless they request anonymity.
- We will request a CVE identifier for qualifying vulnerabilities.
Security Advisories
Advisories are published at https://aui.kasadara.com/advisory/ and include:
- affected packages and versions;
- fixed versions;
- CVSS severity and vector;
- description and impact;
- workarounds, where available;
- CVE identifier, where assigned;
- reporter credit.
Scope
In scope: the published packages @absoluteui/core, @absoluteui/components, @absoluteui/theme, @absoluteui/icons, @absoluteui/utilities, @absoluteui/helpers, and @absoluteui/angular, and the websites https://aui.kasadara.com, https://aui-docs.kasadara.com, and https://aui-designer.kasadara.com.
Out of scope:
- vulnerabilities in consuming applications that do not originate in AbsoluteUI code;
- use of AbsoluteUI configurations explicitly documented as unsafe (for example consumer-allowlisted HTML elements or attributes; see the security guide);
- issues that only affect browsers outside the published supported-browser matrix;
- modified copies of AbsoluteUI (modification is not permitted by the license);
- findings from automated scanners without a demonstrated impact.
Safe Harbor
We will not pursue legal action against researchers who, in good faith:
- follow this policy;
- avoid privacy violations, data destruction, and service disruption;
- test only against their own installations and data;
- give us reasonable time to remediate before disclosure.
Reverse engineering performed solely to identify and report a vulnerability under this policy is authorized for that purpose, notwithstanding Section 3(7) of the license.
Contact
Kasadara Technology Solutions Pvt Ltd, 25, Avinashi Rd, TNHB Colony, Indira Nagar, Civil Aerodrome Post, Coimbatore, Tamil Nadu 641014, India. Security reports: security@kasadara.com. Other legal matters: legalops@kasadara.com.