OFFTRACKMEDIA Studios — ABN 84 290 819 896
| Version | Supported |
|---|---|
| 1.x (latest) | Yes |
| < 1.0 | No |
Do not file public GitHub issues for security vulnerabilities.
To report a vulnerability responsibly:
- Email the maintainers at the contact address listed on the OFFTRACKMEDIA Studios GitHub profile.
- Include in your report:
- A description of the vulnerability
- Steps to reproduce
- Potential impact assessment
- Suggested mitigations (optional)
- Allow up to 7 business days for an initial response.
- Allow up to 90 days for remediation before public disclosure.
This policy covers:
- The
briefkitPython package published to PyPI - The source code in this repository
- Generated output behavior (e.g., PDF metadata injection, path traversal)
Out of scope:
- Third-party dependencies (report those to the relevant upstream project)
- Content accuracy in generated PDFs (content is a user responsibility)
| Practice | Standard |
|---|---|
| Secrets in code | Prohibited — no hardcoded credentials |
| Input validation | Applied at all system boundaries |
| Dependencies | Minimized — two runtime dependencies (ReportLab, PyYAML) |
| Offline operation | No external API calls during PDF generation |
| Filesystem access | Read-only on source files; write-only for output PDFs and registry |
| SQL / query injection | Not applicable — no database connections |
| Code execution | No eval() or exec() with user input |
Responsible disclosures are acknowledged in the changelog. Reporters who wish to remain anonymous will have their identity protected.
(c) 2026 OFFTRACKMEDIA Studios · ABN 84 290 819 896