PDF-Wizard is a 100% client-side application. It has no backend, stores no user data, and makes no network requests at runtime — every PDF operation happens locally in the browser via JavaScript and WebAssembly in Web Workers. Uploaded files never leave the user's device. This design removes entire classes of risk (no server to breach, no data in transit, no third-party processors).
The latest main (and the most recent release) receives security fixes.
| Version | Supported |
|---|---|
latest main / newest release |
✅ |
| older releases | ❌ |
Please do not open a public issue for security problems.
Instead, report privately via GitHub's Report a vulnerability (Security → Advisories), or email the maintainer at atharva.shukla2367@gmail.com.
Include:
- a description of the issue and its impact,
- steps to reproduce (a minimal case — no confidential PDFs),
- affected browser/OS and version/commit.
You can expect an acknowledgement within a few days. Please give a reasonable window to release a fix before any public disclosure.
Examples of in-scope issues:
- a code path that would cause a file or its contents to be sent off-device,
- XSS or code execution via a crafted PDF/image/Office file,
- a dependency vulnerability that is actually reachable in the app.
Out of scope: findings that require a already-compromised machine or browser,
and the known dev-only transitive advisories documented in CLAUDE.md.