819 B
Security
Report vulnerabilities privately through the repository owner on the Gitea instance. Do not attach confidential merge data to a public issue.
Label Tools keeps data in browser memory and accepts only bounded CSV/JSON and PNG/JPEG/WebP assets. Merge text and SVG attributes are escaped. Generated barcode markup comes from a pinned local encoder and is checked for active or linked elements. Remote image URLs, user-provided SVG and arbitrary templates containing markup or code are not accepted in v0.2. Imported template JSON is restricted to the bounded declarative v1 element schema.
Generated labels can contain sensitive or guessable identifiers. Review the preview and warnings before export, and do not treat serial/random values as an access-control system without an independent security design.