There is no versioned release yet. Security fixes apply to the current public
main branch until the first release defines a support window.
Do not open a public issue for a suspected vulnerability. Use the affected repository's Security tab and select Report a vulnerability. Include the commit, browser or runtime, minimal reproduction, impact, and whether user data left the browser.
Do not include real secrets, private application assets, or third-party data in a report. The project does not promise a response deadline while it has one maintainer, but reports will be triaged before any affected release.
- PNG and JPEG files are untrusted input and are decoded by the browser.
- The editor rejects selected files above 16 MiB or 16,777,216 source pixels; Rust independently caps Retina output at 16,777,216 pixels.
- Direct WebAssembly callers hold all supplied PNG and ZIP bytes in their own browser memory and must budget those buffers accordingly.
- Layout objects are validated in Rust before ZIP creation.
- ZIP member names are fixed; user input cannot choose output paths.
- User files and generated bytes remain in browser memory until download.
- The hosted application has no upload route, remote API, analytics, cookie, or persistence path.
- A downstream packager must treat the ZIP and JSON as untrusted and keep macOS signing and notarization credentials outside this project.
- Input validation or resource-limit bypasses.
- Incorrect formal-background or preview separation.
- ZIP path or contract violations.
- Unexpected network transmission or persistence of user data.
- Script injection, unsafe DOM rendering, or browser-origin boundary failures.
Final DMG creation, Finder automation, signing, notarization, Worker sessions, and MCP transports are not implemented and are therefore outside the current product scope.