# Security

Report vulnerabilities privately through the repository owner on the Gitea
instance. Do not attach confidential packages to a public issue.

Package Tools processes untrusted archives locally. Its main controls are
source/entry/count/expansion limits, strict CRC and overlap checks before
extracting a selected entry, path normalization and collision diagnostics,
DTD/entity rejection, bounded JSON parsing, no script execution, and no remote
reference resolution. A browser or dependency decoder vulnerability remains
outside the guarantees of the application; keep dependencies and browsers
current.