Security Policy & Reporting
Security is paramount for KissThePDF. Because user documents may contain sensitive financial, medical, or legal data, our architecture is designed to minimize attack vectors.
Security Policy
We actively support the latest release version on the main branch. For repository security policies, refer to the root SECURITY.md file.
Reporting a Vulnerability
If you discover a security vulnerability, please DO NOT report it by opening a public GitHub issue.
Please email the maintainers or open a private GitHub Advisory report at:
https://github.com/positiveabhii/kiss-the-pdf/security/advisories
Security Principles
- 1. Client-Side IsolationBy processing files strictly within the client tab context, KissThePDF eliminates server-side storage vulnerabilities, database breaches, and cloud storage leaks.
- 2. Dependency AuditingWe audit npm dependencies routinely to keep packages updated and minimize external attack surfaces.
- 3. Strict Content Security PolicyOur headers enforce strict CSP rules preventing inline script injections or unauthorized external network connections.
Untrusted Input Handling
Any file uploaded by a user is treated as untrusted input. Parsing engines (`pdf-lib`, `PDF.js`) handle malformed or corrupt PDF streams gracefully without compromising browser memory stability.
KissThePDF is 100% Free & Open Source
All code runs locally in your browser. Contribute code, report bugs, add new tools, or star the repository to support privacy-first software.