Imprimatur processes untrusted PDFs, form data, annotations, and certificate material. Please report vulnerabilities privately and avoid attaching sensitive documents to public issues.

Security fixes target the current main branch and the newest published release, when one exists. Pre-release source builds may change rapidly; include the exact commit in every report.

Use GitHub’s Security → Report a vulnerability private reporting flow for 8tp/imprimatur. If private reporting is unavailable, open a public issue containing no exploit, private document, credential, or sensitive technical detail and ask a maintainer for a private contact channel.

Include, when safe:

• affected commit or release;
• macOS version and architecture;
• affected document type and operation;
• minimal reproduction steps using a synthetic fixture;
• security impact and trust boundary crossed; and
• whether the issue requires user interaction, network access, a signing identity, or external hardware.

Do not send real government forms, personal data, passwords, API keys, certificates with private keys, Keychain exports, token PINs, notary credentials, or proprietary documents.

Maintainers will acknowledge a private report, reproduce it when possible, assess the affected boundaries, and coordinate remediation and disclosure. Timelines depend on severity, reproducibility, and whether upstream PDFium, macOS, OpenSC, or another dependency is involved. Please do not disclose the issue publicly before a fix and release plan are available.

Imprimatur is local-first, but local processing is not the same as zero risk. The project uses:

• a supervised per-document PDFium/V8/XFA helper;
• private staging directories and atomic publication;
• macOS Seatbelt restrictions for helper network, child-process, Mach-service, and ambient filesystem access;
• request deadlines, kernel limits, parser budgets, and a memory watchdog;
• Security.framework and PKCS#11 provider boundaries for private keys; and
• diagnostics designed to omit form values, credentials, and signing secrets.

The direct-download app is hardened-runtime enabled but is not App Sandbox-enabled because user-directed document, helper, printing, Keychain, and smart-card workflows require capabilities documented in packaging/SECURITY-POSTURE.txt.

Known product limits are documented in docs/limitations.md. A missing sandbox entitlement or unsupported parser path should not be assumed to be exploitable without demonstrating the boundary and impact.