Reporting
Please report security issues privately rather than in public. We aim to acknowledge within 72 hours.
Include what you found, how to reproduce it, and what you think the impact is.
If it involves a particular PDF, please describe its structure rather than sending the file. We would rather not receive your documents — that is rather the point of the product.
What we treat as high severity
Anything that breaks a guarantee on the threat model page.
- Document bytes reaching a server during editing, by any path at all.
- Redacted content surviving in an exported file. Drawing a black box over live text is the classic catastrophic bug in PDF tooling and we treat any instance as critical — it is also what our own verification pass exists to make impossible.
- Loss of cross-origin isolation in the editor, or a third-party origin appearing in the editor’s Content-Security-Policy.
- The hidden-content detector missing a category of concealed text it claims to find.
Out of scope
- Malicious browser extensions and compromised devices, as set out in the threat model.
- Opening a very large file and exhausting your own browser’s memory. The pre-flight check refuses these deliberately; a crash instead of a refusal is a bug, a slow render is not.
- Reports that a tool did not find something it never claimed to look for. The pages say what each tool does and does not do.