Security fixes are made on the newest Public Alpha line. Older alpha builds may receive no backport and should be upgraded before reporting behavior that is already fixed in the current release.

Please do not open a public issue containing vulnerability details, exploit material or a sensitive image. GitHub Private Vulnerability Reporting is the supported disclosure channel for the published repository and must be enabled before the repository becomes public. If that channel is unavailable, open only a detail-free issue saying that the private security channel is unavailable; a maintainer can then arrange private follow-up.

Include the affected version, operating system, Python version, minimal reproduction and impact. Remove personal images and local paths unless they are essential and explicitly safe to share.

ChromaRecover accepts untrusted PNG, JPEG and WebP files, so changes must preserve decoded format checks, the 100 MiB file limit, 50 MP per-image limit, burst frame-count check and 80 MP aggregate burst limit. Embedded ICC profiles are limited to 4 MiB before LittleCMS, and user-supplied perspective coordinates are validated before OpenCV transforms. Output artifact names are generated by the library. The CLI is local-first and must not add telemetry or uploads without explicit opt-in and a public design review.

The local Python process does not provide a hard decoder timeout or protection from an unknown native-library vulnerability. Hosted and multi-user integrations must use an unprivileged worker process with OS-enforced memory and wall-time limits. See docs/security-model.md for the threat model and deployment guidance.