Do not file a public GitHub issue for security bugs.

Please report security issues privately via GitHub's Private Vulnerability Reporting. The maintainer will acknowledge within a reasonable timeframe and coordinate a fix and disclosure.

Examples of issues in scope:

• Parser bugs in template / .docx loading that lead to arbitrary code execution, prototype pollution, or path traversal when reading user-supplied files.
• XML-related vulnerabilities (XXE, billion-laughs, entity expansion) when parsing untrusted .docx packages.
• Zip-slip / archive-extraction issues in the OPC (OOXML packaging) layer.
• Output-side injection: generated XML/OOXML that escapes its escaping when given attacker-controlled text or attributes.
• Vulnerabilities in this project's bundled / vendored dependencies.
• Supply-chain issues with anything we publish on npm.

Out of scope by default:

• Pure denial-of-service from arbitrarily large input (callers are expected to bound input themselves).
• Concerns about the project's license itself.
• Issues that already have a public CVE upstream and where this project is only transitively affected — please report those upstream first; we will bump our pin once they release a fix.

We patch the most recent minor release line. Pre-1.0, this is the latest 0.Y.x release. After 1.0, the latest X.Y.x of the current major.