ScanPDF processes documents entirely in the browser and never transmits user data. Security issues are still possible — for example in how third-party libraries are fetched and pinned, in the Content-Security-Policy, or in the container configuration.

Please do not open a public issue for security problems. Instead, report them privately via GitHub Security Advisories.

You can expect an initial response within a week. Please include steps to reproduce and the impact you believe the issue has.