Found a vulnerability? Report it privately
Please don't open a public issue for security problems. Every TerraFluent repository accepts private reports through GitHub Security Advisories.
How to report
Use GitHub's private vulnerability reporting on the repository of the affected package — Security → Report a vulnerability, or go there directly:
- Report a vulnerability in TerraFluent.Pdf.Reporting
- Report a vulnerability in TerraFluent.Html.Reporting
- Report a vulnerability in TerraFluent.Docx.Reporting
A useful report describes the affected package and version, the impact, and ideally a proof-of-concept. You'll get an acknowledgement in the advisory thread, and credit in the fix release unless you prefer otherwise.
Supported versions
Security fixes target the latest released version of each package — currently TerraFluent.Pdf.Reporting 2.0.2, TerraFluent.Html.Reporting 1.1.1, and TerraFluent.Docx.Reporting 1.3.0. Older versions do not receive backported fixes; upgrading is free and, within a major version, source compatible.
Scope worth knowing about
- Zero runtime dependencies. All three packages ship with no dependencies beyond the .NET base class library (verifiable in each package's nuspec on NuGet), so there is no transitive dependency tree to audit or patch.
- No network or process access. The libraries are pure document writers: they take your data in, write bytes out, and make no network calls, spawn no processes, and load no native binaries.
- PDF encryption. TerraFluent.Pdf.Reporting encrypts documents with AES-256 by default (AES-128 available for legacy viewers) with user/owner passwords and permission flags — see the encryption documentation for what PDF permissions do and don't protect against.
Repository security policies
Per-repository SECURITY.md files:
- TerraFluent.Pdf.Reporting SECURITY.md
- TerraFluent.Docx.Reporting SECURITY.md
- TerraFluent.Html.Reporting — use the private reporting form.