Security fixes are applied only to the latest released version on the main branch (and the matching PyPI release of md-cv-gen).

Please do not open a public issue. GitHub's private vulnerability reporting is the preferred channel:

1. Go to the repository's Security tab.
2. Click Report a vulnerability.
3. Describe the issue with reproduction steps and a suggested mitigation.

If you cannot use GitHub's form, email goabonga@pm.me with the same information. PGP encryption is available on request.

You can expect an acknowledgement within 3 business days, a triage assessment within 10 business days, and a fix or written mitigation plan before any public disclosure.

md-cv-gen reads a Markdown file and renders it to HTML/PDF via WeasyPrint and pikepdf. Security-relevant reports typically concern the handling of untrusted Markdown input or the PDF encryption path. Vulnerabilities in the underlying rendering libraries should be reported upstream, but please let us know so the pinned dependency ranges can be bumped.

Thanks for helping keep the project and its users safe.