Please report suspected security vulnerabilities privately to the maintainer by email:

• RK Riad Khan — rkriad585@gmail.com

Please do not open a public issue for security problems.

When reporting, include:

• The version or commit you are running
• A description of the vulnerability
• Steps to reproduce
• Any impact assessment you can provide

You will receive an acknowledgment within 7 days and a status update as the issue is assessed and addressed.

H9A is a small terminal package with two runtime dependencies (rich and pyfiglet) and one optional dependency for screenshots (Pillow). It reads no input, makes no network requests, and stores no data. The practical attack surface is limited to the behavior of its dependencies and the environment in which it is run.

Security updates for h9a, rich, pyfiglet, and Pillow should be tracked with the standard package tooling:

python -m pip list --outdated