mde
diff --git a/‎SECURITY.md‎
Lines changed: 2 additions & 0 deletions b/‎SECURITY.md‎
Lines changed: 2 additions & 0 deletions
@@ -18,3 +18,5 @@ To ensure the timely response to your report, please ensure that the entirety of
 
 The EJS team will then evaluate your report and will reply with the next steps in handling your report and may ask for additional information or guidance.
 
+## out of scope vulnerabilities
+If you give end-users unfettered access to the EJS render method, you are using EJS in an inherently un-secure way. Please do not report security issues that stem from doing that. EJS is effectively a JavaScript runtime. Its entire job is to execute JavaScript. If you run the EJS render method without checking the inputs yourself, you are responsible for the results.
Original file line number	Diff line number	Diff line change
`@@ -18,3 +18,5 @@ To ensure the timely response to your report, please ensure that the entirety of`
`18`	`18`
`19`	`19`	`The EJS team will then evaluate your report and will reply with the next steps in handling your report and may ask for additional information or guidance.`
`20`	`20`
	`21`	`+## out of scope vulnerabilities`
	`22`	`+If you give end-users unfettered access to the EJS render method, you are using EJS in an inherently un-secure way. Please do not report security issues that stem from doing that. EJS is effectively a JavaScript runtime. Its entire job is to execute JavaScript. If you run the EJS render method without checking the inputs yourself, you are responsible for the results.`