We take reports seriously and appreciate responsible disclosure.

Please do not open a public issue for a security problem. Instead use GitHub's private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability. That starts a private channel with the maintainer so the issue can be fixed before it is disclosed.

Please include:

• what the problem is and where in the code it lives,
• how to reproduce it (a minimal example if you can), and
• the impact you believe it has.

We will acknowledge your report, keep you posted on the fix, and credit you when it ships (unless you prefer to remain anonymous).

Worth stating plainly, because it is narrower than for a tool that loads into a game process.

snapmap-midi ships no code into any game. It is a local desktop UI, command-line tool, and Python library. It reads a MIDI file you choose and writes a map file. Audio setup can also read soundbanks from your own DOOM install and write a local preview cache. It opens no network connection — a test enforces that no shipped module even imports an HTTP client or names a loopback address.

So the realistic risks are:

• A malicious MIDI input. Parsing is delegated to mido; a crafted file that causes unbounded memory use or a crash in the parser is a real report and we want to hear it.
• A poisoned sound palette. src/snapmap_midi/data/sound_palette.json is package data that decides which sound every note resolves to. It holds identifiers only — no audio, no paths, no code — so the worst a tampered entry can do is name a sound the game does not have, or name a different one than intended. That is a correctness problem rather than a code-execution one, but it is a supply-chain surface and it is owned accordingly.
• A compromised dependency. mido parses MIDI everywhere; pywebview hosts the desktop UI on Windows. Dependabot watches the Python dependencies and GitHub Actions.
• A compromised release path. Covered below.

Out of scope: anything that requires the attacker to already control the files you feed the tool, or the machine it runs on.

Security fixes are made against the latest release; older releases are not back-patched.

• Pull requests run in a secretless sandbox: fork PRs get a read-only token and no repository secrets.
• Any change to a supply-chain-critical path — the CI workflows, the dependency declaration — requires maintainer review before it can merge.
• Every merge to the default branch requires a passing guard and test gate.
• Third-party GitHub Actions are pinned to full commit SHAs, not tags.
• CI fails the build if any game data or an unexpected binary is committed.

Thank you for helping keep snapmap-midi and its users safe.