Security fixes are applied to the latest tagged version.

Use GitHub's private vulnerability reporting for this repository. Do not include real footage, production names, credentials, or private file listings in a public issue. A minimal synthetic plan, log, and directory layout is preferred.

Include the CallItWrap version, operating system, exact command, expected result, and actual result.

CallItWrap is offline and standard-library-only at runtime. It reads TOML, CSV, and directory names; it does not open media content, execute filenames, call a shell, or access a network. It rejects absolute/traversing media paths, symbolic links in the inventoried tree, case-insensitive path collisions, malformed schemas, and inconsistent take-group metadata. Generated HTML escapes input text and contains no scripts. Formula-like text is neutralized in the spreadsheet-facing handoff CSV. Source media is never changed.

The tool does not provide malware scanning, codec validation, checksum verification, backup, access control, or evidence-chain guarantees. Treat READY as a coverage/reference decision, not proof that media bytes are safe or durable.