Security fixes are provided for the latest GitHub Release.

Please use GitHub private vulnerability reporting. Do not post a public issue containing an exploit or private audio.

Include the affected version, platform, minimal reproduction, and impact. You should receive an acknowledgment within seven days.

SpliceSentry operates locally and has no telemetry or network code. WAV and JSON files are untrusted inputs: their container structure and documented limits are validated before analysis. HTML labels and messages are escaped, reports are script-free, CSV cells are protected against spreadsheet formula execution, and source audio is opened read-only.

The project does not promise safe processing of files that exceed available disk or memory resources, nor does it sandbox the Node.js runtime itself.