helper-tools/SECURITY.md

Security policy

Report suspected vulnerabilities privately to the repository owner through the Gitea security contact rather than filing a public exploit description.

Helper Tools processes values locally. It does not make runtime network requests, persist calculator inputs, evaluate parsed data, or inject generated markup. Inputs, decoded outputs, collections and nesting are bounded. Downloads use sanitized names and revocable object URLs.

Consumers remain responsible for treating decoded URLs, CSV cells, JSON values, random-looking data and generated text as untrusted when handing them to another system. Seeded randomness is reproducible and must never be used for secrets.