@m8t-jacob/faker-pl has zero runtime dependencies and performs no I/O — it only generates synthetic data with a deterministic, non-cryptographic PRNG (mulberry32). It must never be used to produce real identifiers, and generated values must never be treated as valid credentials for anything. The attack surface is limited to the generation logic itself (e.g. a malicious input causing excessive CPU usage, or a checksum bug producing structurally invalid output).

If you discover a security vulnerability, please do not open a public issue. Instead, report it privately via GitHub Security Advisories for this repository.

Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce (a minimal code sample is ideal)
• The package version affected

We aim to acknowledge reports within 5 business days and to release a fix as soon as reasonably possible.