From df4421b0b6aa11d7792f0b03ba833a79fb2da31a Mon Sep 17 00:00:00 2001
From: Alan Agius <17563226+alan-agius4@users.noreply.github.com>
Date: Wed, 28 Oct 2026 16:29:03 +0000
Subject: [PATCH 1/2] docs: update `SECURITY.md` to clarify build-time trust
 boundary

---
 SECURITY.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/SECURITY.md b/SECURITY.md
index 1d62d6ccd8ae..42f906681968 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -9,10 +9,11 @@ The following defines some team policies around what does and does not constitut
 - Prototype pollution is itself a DoS vulnerability.
   - An attacker could pollute any symbol into the wrong type and cause an error, nothing we can do will prevent that.
   - Therefore we don't care about any DoS vulnerability which relies on prototype pollution as a precondition.
-- We trust the user's source code.
+- We trust the user's source code and build-time inputs.
   - "A malicious repository can execute untrusted code" is not a viable attack vector.
   - A malicious repository could always rebind `node_modules/.bin/ng` to do something malicious, nothing we do can prevent that.
   - We assume it is always unsafe to run an untrusted repository outside of a sandbox.
+  - Build-time configuration (`angular.json`, `routesFile`, environment variables) and values returned by developer-authored build-time functions (such as `getPrerenderParams()`) are considered trusted inputs. Passing unvalidated, untrusted data from an external source (ex. a CMS or database) into build-time route generation or build configuration is an application-level input validation defect, not a vulnerability in Angular.
 - DoS attacks which break only the attacker's client are not security issues.
   - Exception: DoS attacks which waste server resources significantly beyond the cost of the attacker's request may be security issues.
 - Memory leaks are considered general bugs, not DoS vulnerabilities.

From fce83fc128de6cb06a742025bdf4c7bb49293487 Mon Sep 17 00:00:00 2001
From: Alan Agius <17563226+alan-agius4@users.noreply.github.com>
Date: Wed, 28 Oct 2026 16:33:51 +0000
Subject: [PATCH 2/2] fixup! docs: update `SECURITY.md` to clarify build-time
 trust boundary

---
 SECURITY.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SECURITY.md b/SECURITY.md
index 42f906681968..5e6fbc1b4b54 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -13,7 +13,7 @@ The following defines some team policies around what does and does not constitut
   - "A malicious repository can execute untrusted code" is not a viable attack vector.
   - A malicious repository could always rebind `node_modules/.bin/ng` to do something malicious, nothing we do can prevent that.
   - We assume it is always unsafe to run an untrusted repository outside of a sandbox.
-  - Build-time configuration (`angular.json`, `routesFile`, environment variables) and values returned by developer-authored build-time functions (such as `getPrerenderParams()`) are considered trusted inputs. Passing unvalidated, untrusted data from an external source (ex. a CMS or database) into build-time route generation or build configuration is an application-level input validation defect, not a vulnerability in Angular.
+  - Build-time configuration (`angular.json`, `routesFile`, environment variables) and values returned by developer-authored build-time functions (such as `getPrerenderParams()`) are considered trusted inputs. Passing unvalidated, untrusted data from an external source (e.g., a CMS or database) into build-time route generation or build configuration is an application-level input validation defect, not a vulnerability in Angular.
 - DoS attacks which break only the attacker's client are not security issues.
   - Exception: DoS attacks which waste server resources significantly beyond the cost of the attacker's request may be security issues.
 - Memory leaks are considered general bugs, not DoS vulnerabilities.