# Security

Please report vulnerabilities privately to the repository owner. Do not attach sensitive source files to public issues. Imported images and recognized text are untrusted; decoder, pixel and page limits must remain bounded, outputs must remain inert, and the OCR runtime/model must stay pinned and same-origin.