We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

1. GitHub Security Advisories (Preferred): Use GitHub's private vulnerability reporting to submit a report directly.

2. Email: If you prefer email, contact the maintainers directly (see repository for contact information).

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Any suggested fixes (optional)

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 7 days
• Resolution Target: Depends on severity, typically within 30 days for critical issues

When using Slideforge, be aware of the following security considerations:

• Input Files: Slideforge processes JSON and markdown files. Always validate input from untrusted sources.
• Output Files: Generated PPTX files are standard Office Open XML format.
• File Paths: Ensure output directories have appropriate access controls.

• Output Directories: The exports/ directory contains generated presentations. Ensure appropriate access controls in production environments.
• Virtual Environment: Use the project's virtual environment to isolate dependencies.

• All dependencies are regularly monitored for security updates.
• Run pip install --upgrade -r scripts/requirements.txt periodically to get security patches.

We follow responsible disclosure practices:

1. Security issues are addressed before public disclosure
2. Credit is given to reporters (unless anonymity is requested)
3. A security advisory is published after the fix is released