Please report vulnerabilities privately through GitHub Security Advisories for this repository. Do not open a public issue for secrets exposure, path traversal, unsafe archive handling, or unintended source transmission.

Include the affected version, reproduction steps, impact, and any suggested mitigation. Avoid attaching real credentials, private brand sources, or licensed assets; use a minimal synthetic fixture.

URLs in assets/manifest.json are inert metadata. The bundled resolver does not contain a network client and never executes those URLs. Download remote content only through a separate environment-authorized tool with its own egress controls, then pass the resulting local file with --source-file. Resolution requires a valid manifest SHA-256 and verifies it before creating output.

Security-sensitive areas include:

• path traversal or overwriting outside the selected output directory;
• accidental inclusion of credentials, local paths, or private URLs;
• scripts that transmit source material without clear user authorization;
• asset manifests that mark restricted material as redistributable;
• validation bypasses that allow unresolved or misleading provenance.
• asset resolvers that perform any network request, execute a manifest URL, accept unsafe package paths or symbolic links, skip checksum verification, or write outside the selected destination;
• semantic-diff or production-status bypasses that allow changed content or unresolved rights to be reported as production-ready.

The project does not provide a security SLA. Reports will be acknowledged and prioritized according to impact.