Please report security issues privately using GitHub's Report a vulnerability feature where available, rather than opening a public issue with an exploit payload. Include the input HDL/comment text and generated output showing the issue.

DoxNet handles untrusted source as data, not as executable HDL. HTML and source-link handling are designed to avoid executing markup from comments. Do not deploy generated documentation as privileged web content until you've reviewed its inputs and your hosting configuration.

Supported releases: the latest published stable release and the active development branch, on a best-effort basis.