If you discover a security issue in PDF Craft:

1. Do not open a public GitHub issue for exploitable vulnerabilities.
2. Email or open a private security advisory on GitHub (preferred if enabled).
3. Include:
   • PDF Craft version (PDF Craft v… in the window title)
   • Operating system
   • Steps to reproduce
   • Impact (e.g. arbitrary file write, path traversal, code execution)
   • Proof of concept if available

We aim to acknowledge reports within 7 days and provide a fix or mitigation timeline when possible.

In scope

• PDF parsing, saving, encryption, and conversion logic in core/
• Path handling, plugin loading (~/.pdf-craft/plugins/), and CLI argument parsing
• Denial of service via malicious PDFs (within reason — document crashes for review)

Out of scope

• Antivirus false positives on PDFCraft.exe (see docs/TRUST.md)
• Third-party tools: Tesseract, Poppler, Microsoft Word, PyMuPDF AGPL licensing
• Issues in dependencies — report upstream when appropriate; we will bump versions when fixes exist

• PDF Craft processes files locally. It does not upload documents to a cloud service.
• Only install PDFCraft.exe from official GitHub Releases after verifying SHA256 checksums.
• Plugins run Python code from ~/.pdf-craft/plugins/ — install plugins only from sources you trust.

We follow coordinated disclosure: we fix critical issues, release a patched version, and credit reporters in CHANGELOG.md unless they prefer anonymity.