This library parses files that arrive from outside your system. A malformed PDF that makes it crash, hang, or allocate without bound is not a robustness bug — it is a denial of service in whatever service embeds it. Those reports are treated as security reports.

"Without bound" means past the reader's limits in force. They are on by default; an application that raises them, or chooses PdfReaderLimits.Unbounded for documents it trusts, lets a file use what those limits allow, and that is by design. A file that makes the reader exceed a limit it is under is a vulnerability.

So are: reading outside the bounds of the input, following a reference in a file to a resource on the machine, and anything that lets a document's content influence what the host process does beyond returning data.

While the version is below 1.0, only the latest published version receives fixes. After 1.0, the latest major does.

Please do not open a public issue.

Use GitHub's private vulnerability reporting: Report a vulnerability. That opens an advisory visible only to the maintainer, and is the fastest way to get a fix moving without disclosing the issue before a patch exists. The same form is behind the Security tab of this repository, under Advisories.

If a document reproduces the problem, attach it — a file that triggers the bug is worth more than any description of it. If the document is confidential, say so and send a reduced or synthetic reproduction instead; the reporting thread is private, but a published advisory and its regression test are not.

You should get an initial response within a few days. A confirmed report is fixed privately, and a GitHub Security Advisory is published alongside the patched release, crediting the reporter unless they prefer otherwise. Published advisories are listed on the advisories page.

Its supply-chain posture is measured rather than asserted, and the report is public: the OpenSSF Scorecard report. Every GitHub Action used by a workflow here is pinned to a commit hash, NuGet dependency versions are set in one central file, and every merge is analyzed by CodeQL. Lock files for the restore are not committed yet (#43).

Every package published from 0.2.0-preview on, and every assembly inside it, carries a signed SLSA build provenance attestation, made by the workflow run that built it (ADR 49). nuget.org re-signs every .nupkg it accepts, which changes the file's digest, but leaves the assemblies inside as they were built, and NuGet restores them unchanged. So a package restored from nuget.org is checked through its assembly, with the GitHub CLI:

gh attestation verify ~/.nuget/packages/adcodicem.pdf/<version>/lib/net10.0/AdCodicem.Pdf.dll \
  --repo AdCodicem/AdCodicem.Pdf \
  --signer-workflow AdCodicem/AdCodicem.Pdf/.github/workflows/preview.yml

For a preview the signer is preview.yml. Earlier previews, 0.1.1-preview.*, carry no attestation.

What the library defends against, where each defense lives, and the defenses still missing are written down in the threat model.