Current production readiness and security guidance for Diet-NG

[MehmetAliPolat1515]

Hello,

I am evaluating Diet-NG for use in a new production project and would like to understand its current status and security model.

The README currently describes the project as “almost stable and feature complete and ready for pre-production testing.” Is that description still accurate?

Could you please clarify the following?

1. Is Diet-NG currently considered production-ready?
2. Which release or branch is recommended for new projects?
3. Is the project actively maintained?
4. Are bug fixes and security patches still accepted and released?
5. Has the project undergone any security review, audit, or fuzz testing?
6. What security guarantees are provided by escaped interpolation ("=" and "#{...}")?
7. Is escaping context-aware for HTML text, attributes, URLs, JavaScript, and CSS?
8. Apart from "!=" and "!{...}", are there other mechanisms that can produce unescaped output?
9. Are Diet templates always assumed to be trusted application source code?
10. Is processing user-controlled or user-editable templates explicitly unsupported?
11. Are "DietUseLive" and "DietUseCache" intended only for development?
12. Are there recommended production-hardening practices?
13. Is there a preferred private process for reporting security vulnerabilities?

An update to the README describing the current maintenance status, supported threat model, and recommended production configuration would also be very helpful.

Thank you.