Please do not open a public GitHub issue for security vulnerabilities.

Preferred channel: GitHub private vulnerability reporting.

Email contact: byronawilliams@gmail.com. Use this if GitHub private vulnerability reporting is unavailable, or if you prefer email. Encrypt sensitive details with the maintainer's GPG key on request.

Include in your report:

• A description of the vulnerability and its impact
• Steps to reproduce (proof-of-concept code is welcome)
• The affected version(s) and configuration
• Any suggested mitigation, if known

You will receive a response within 72 hours acknowledging receipt. Initial triage and severity assessment will be completed within 14 days of acknowledgment.

If the vulnerability is confirmed, a fix will be prioritized based on severity:

• Critical / High: patch released within 7 days
• Medium: patch released within 30 days
• Low: addressed in the next scheduled release

You will be credited in the release notes unless you request otherwise.

This tool downloads and processes publicly available GLEIF data files. It does not handle authentication credentials, payment data, or personal information beyond what is present in the GLEIF golden copy datasets (which are public records).

The primary security surface areas are:

• Dependency vulnerabilities: tracked with uv run pip-audit and OSV Scanner
• ZIP path traversal: mitigated in download.py via resolve().is_relative_to() check before extraction
• SQL injection: mitigated by parameterized DuckDB queries in queries.py