Please report privately rather than opening a public issue:

• GitHub Security Advisories — use the "Report a vulnerability" button on the repository's Security tab (preferred)

Please include:

• what the issue allows an attacker to do
• steps to reproduce
• affected version and platform
• a generated fixture, never a real document: section-weave fixtures --name source --out ./A.docx

We aim to acknowledge within 5 working days and to ship a fix or a documented mitigation within 30 days for confirmed issues. We will credit you unless you ask us not to.

Anything that breaks a promise the project makes:

• reading a file the user did not name
• writing outside the declared output paths
• modifying document A or B
• overwriting an existing file without the double confirmation
• any network access
• document content appearing in JSON output, logs or error messages
• a leftover temporary file containing document content
• producing a corrupt document that passes verification
• path traversal, symlink or TOCTOU issues in sectionweave.paths
• a crafted document causing code execution, or resource exhaustion that the existing size and entry limits should have caught

Documented in docs/threat-model.md, and not defended against:

• an attacker who already has your OS privileges
• vulnerabilities in lxml/libxml2 or olefile themselves — report those upstream; we will ship a version bump
• the absence of an OS-level sandbox (Section Weave is an application-level constraint; the threat model says so explicitly and shows how to add a real sandbox)
• macros in .docm files, which are carried through untouched and never executed by this tool
• the residual os.link fallback race on filesystems without hard links, which is disclosed in the threat model
• reports that consist only of an automated scanner's output with no analysis

For genuinely sensitive documents, run under an OS-level sandbox with --network=none. Recipes are in the threat model.