feat: release Office Tools 0.1.0

2026-08-31 22:37:01 +02:00
commit a5524e27e3
90 changed files with 16328 additions and 0 deletions
@@ -0,0 +1,32 @@
+# Security policy
+
+Office files are untrusted structured packages. Reports about package traversal,
+resource exhaustion, unsafe markup, external-resource loading, active-content
+execution or privacy leakage are particularly welcome.
+
+## Reporting
+
+Please report a vulnerability privately to the repository owner through the
+private contact mechanism on <https://git.add-ideas.de/lotobo/office-tools>.
+Include the affected version, browser, a minimal reproducer when safe, and the
+expected security boundary. Do not attach confidential source documents; reduce
+them to synthetic fixtures first.
+
+## Supported versions
+
+Only the latest tagged release receives security fixes before version 1.0.
+
+## Security boundary
+
+Office Tools promises local processing and no intentional telemetry or upload.
+It does not promise that every malformed package can be recovered or that every
+browser is immune to memory pressure. The implementation must:
+
+- reject traversal, absolute and ambiguous package paths;
+- bound compressed size, expanded size, entry count, XML depth and rendered
+  output;
+- render parsed data through application-owned components rather than trusting
+  imported HTML;
+- never execute macros, scripts, OLE objects or embedded executables;
+- avoid automatic network access for document relationships and links; and
+- release object URLs, workers and large buffers when a document closes.