repro-tools/public/SECURITY.md

Security policy

Report vulnerabilities privately to the repository owner. Supported version: 0.1.x.

Repro Tools performs no uploads, telemetry or third-party calls. Files are processed in memory under explicit size and count limits. Paths are normalized and traversal/absolute paths are rejected before packaging. ZIP contents are created, not extracted.

The optional signing key is generated by Web Crypto, is non-exportable and lives only in the current page. A signature does not confer identity or trust on its public key.