Report security problems privately. Use the Report a vulnerability button on the repository's Security tab, or email grangedevgroup@gmail.com with "Security" in the subject.

Include the Mapkern version, the browser and device, the steps or data that trigger the problem, and what an attacker could do with it. Please keep the details private until a fix is released.

You will get a reply within three working days.

Only the latest release gets security fixes. Fixes land on main first.

Mapkern treats styles, tile data, GeoJSON, fonts, images and feature properties as untrusted input. Crashes, hangs, script injection or runaway memory use caused by crafted map data are in scope.