710 B
710 B
Security
Report vulnerabilities privately through the repository owner on the Gitea instance. Do not attach confidential merge data to a public issue.
Label Tools keeps data in browser memory and accepts only bounded CSV/JSON and PNG/JPEG/WebP assets. Merge text and SVG attributes are escaped. Generated barcode markup comes from a pinned local encoder and is checked for active or linked elements. Remote image URLs, user-provided SVG and arbitrary templates are not accepted in v0.1.
Generated labels can contain sensitive or guessable identifiers. Review the preview and warnings before export, and do not treat serial/random values as an access-control system without an independent security design.