Security Policy

Supported Versions

This project is distributed as a portable toolkit. Security fixes are delivered through updated releases. Use the latest available release in the repository.

Reporting a Vulnerability

Please report security issues responsibly.

Do not open a public issue for an actively exploitable vulnerability.
Contact the maintainer privately with:
a clear description of the issue,
reproduction steps,
affected versions,
and any proof-of-concept if available.

If you are unsure whether something is security-related, report it anyway and mark it as security-sensitive.

Operational Notes

The toolkit is designed for local/offline work and does not include telemetry.
User-facing operations are launched through launcher_gui.cmd, launcher_project.cmd, and launcher_project_ru.cmd.
Build/release/service tasks are separated into builder_main.cmd and launcher_tools.cmd.
File-processing results are written into output\; reports are written into report\; launcher temp files stay in ._runtime\.
.cmd scripts are checked for UTF-8 without BOM and CRLF-only line endings through install\Check-CmdEncoding.cmd.
OCR and AI rewriting are outside the main toolkit scope.

Handling Untrusted Files

Treat incoming office documents as untrusted input.
Scan them with your normal endpoint protection before processing.
Keep source files staged in input\; project tools write processed copies and reports instead of modifying originals in place.
Review release packages before publishing them externally.