Anydoc Preview is currently in Preview. Security fixes are applied to the latest published release and the default branch.

Please do not open a public issue for a suspected vulnerability. Submit a private report through GitHub Security Advisories.

Include:

• the affected version or commit;
• the operating system and reproduction steps;
• the smallest possible example that demonstrates the issue;
• the expected and actual behavior.

Do not attach private documents, API keys, full application logs, or other personal data. Redact sensitive values before submitting a report.

• Never commit .env files, API keys, credentials, or user documents.
• The Firecrawl key is encrypted through Electron safeStorage and is not exposed to the renderer.
• Documents are sent to Firecrawl only when local anydoc conversion fails or returns no useful text and a key is configured.
• Generated builds, dependencies, and local Vite output are excluded through .gitignore.

For the application data flow and trust boundaries, see docs/architecture.md.