Security fixes are applied to the current main branch. Until the first AccessForge release is tagged, no older fork revision should be considered supported.

Do not disclose a suspected vulnerability in a public issue. Contact the repository owner privately through GitHub and include the affected commit, reproduction steps, impact, and any safe proof of concept. Do not include customer documents, credentials, tokens, or personal information in the report.

The maintainer should acknowledge a report within three business days, validate severity, agree on a disclosure window, and publish a fix or mitigation before public detail is released.

AccessForge processes attacker-influenced files and URLs. Its existing controls include file-size and parser time limits, concurrency caps, OOXML zip-bomb limits, private/reserved-address blocking for URL fetches, hostname allowlists, security headers, rate limiting, hashed one-time codes and tokens, expiring share links, numbered SQLite migrations, and deletion controls for remediation output.

Important limitations:

• The default launch mode has login disabled and is suitable only for a bounded public-document audit service behind operator controls.
• Email OTP is not procurement-grade MFA.
• The application is a single-instance SQLite deployment and does not by itself provide tenant isolation.
• Shared report URLs act like bearer links and remain available until they expire.
• Report and audit metadata are retained for 365 days by the current configuration; document bytes used for ordinary analysis are handled in memory, while remediation artifacts have a separate short lifecycle.
• Optional remediation invokes external tools and must remain disabled until their binaries, licenses, resource limits, and cleanup behavior are verified in the target environment.

• Terminate TLS at a maintained reverse proxy and set PRODUCTION_URL to the exact HTTPS origin.
• Restrict inbound traffic to the web service and required administration paths.
• Set ANALYZE_URL_ALLOWED_HOSTS to the customer-approved public hosts; keep private/reserved-address blocking enabled.
• Generate high-entropy values for every enabled secret; do not reuse development values.
• If the privileged API tier is enabled, generate and rotate API_PRIVILEGED_TOKEN as a secret and never put it in URLs or logs.
• If AUTH_REQUIRE_LOGIN=true, configure a strong JWT_SECRET, verified SMTP_FROM, SMTP credentials, ALLOWED_DOMAINS, and named administrators; test login, logout, revocation, and account removal.
• Keep REMEDIATION_ENABLED=false unless the engagement explicitly requires it and its external runtime is tested.
• Back up the SQLite data volume, encrypt backups, test restore, and document retention/deletion ownership.
• Run pnpm install --frozen-lockfile, pnpm lint, pnpm typecheck, pnpm build, and pnpm test for the exact deployed commit.
• Review dependency advisories and generate a production dependency/license inventory.
• Configure host monitoring for /api/health, disk usage, memory, process restarts, TLS expiry, and backup success.
• Document the incident contact, outage procedure, customer notification threshold, and export/exit process.

• Use public documents or content the customer explicitly authorized.
• Do not submit secrets, private keys, credentials, or regulated records.
• Minimize stored metadata and avoid putting personal information in filenames.
• Treat exported reports and share links as potentially sensitive customer work product.
• Honor the customer's export and deletion request at the end of an engagement.
• Record who enabled remediation and who reviewed its output.

The imported application is pinned in upstream.lock.json; JavaScript dependencies are pinned by pnpm-lock.yaml. Preserve upstream copyright and license text. Review upstream changes before rebasing or copying them, and do not silently replace the pinned source.

Container images, operating-system packages, Chromium, qpdf, OpenDataLoader, and veraPDF have their own security and update lifecycles. Pin and scan the final image used in production rather than treating the Dockerfile's source tag as a complete software bill of materials.