package-tools/public/SECURITY.md

Security

Report vulnerabilities privately through the repository owner on the Gitea instance. Do not attach confidential packages to a public issue.

Package Tools processes untrusted archives locally. Its main controls are source/entry/count/expansion limits, strict CRC and overlap checks before extracting a selected entry, path normalization and collision diagnostics, DTD/entity rejection, bounded JSON parsing, no script execution, and no remote reference resolution. A browser or dependency decoder vulnerability remains outside the guarantees of the application; keep dependencies and browsers current.