Security fixes are applied to the latest 1.x release.

Use GitHub private vulnerability reporting. Do not open a public issue for an undisclosed vulnerability.

Include:

• the affected GlyphPact version and platform
• a minimal input or reproduction
• the diagnostic output and exit code
• whether source data or an output directory changed

Do not attach proprietary artwork unless you have permission to share it.

XML entity expansion, external resource access, path traversal, output ownership bypass, lockfile ABI corruption, font parser failures, and resource exhaustion are treated as security-sensitive.