The Luma project takes software security and user privacy seriously. This document outlines our supported versions, security architecture principles, and the process for responsibly reporting security vulnerabilities.

Only the latest active release branch receives security updates.

Luma is engineered with proactive defense-in-depth principles:

Luma is designed to operate completely offline.

• No analytics, metrics, or telemetry are collected or transmitted.
• No network requests are made during runtime or document inspection.
• All document rendering occurs exclusively in memory and on local disks.

Any file opened by the user (via CLI flag --open or file picker) is sanitized through validate_file_path() in src/security.py:

• Relative segments (../) and symbolic links are strictly resolved.
• Strict boundary checks prevent access outside authorized directories.
• File existence and OS read permissions are verified before opening.

When external system tools or build helpers are invoked:

• Commands are executed strictly using argument lists (never shell string interpolation).
• User input is never passed unescaped to shell interpreters.

To prevent resource exhaustion and descriptor leaks:

• All file operations use deterministic context managers (with open(...)).
• Archive inspections close file archives immediately upon reading catalog metadata.

• All dependencies in requirements.txt and requirements-dev.txt are pinned to exact versions.
• Continuous Integration runs pip-audit on every push and pull request to verify that no high- or critical-severity CVEs exist in dependencies.

If you discover a potential security vulnerability in Luma, please report it responsibly:

1. Do not create a public issue. Please report the issue privately using GitHub Security Advisories or via email to security@luma.local.
2. Include detailed information:
   • A description of the vulnerability and its potential impact.
   • Exact steps or minimal proof-of-concept file to reproduce the issue.
   • Operating system and version of Luma tested.
3. Response Timeline:
   • Initial Acknowledgment: Within 48 hours.
   • Assessment & Triage: Within 5 business days.
   • Patch & Advisory: Coordinated release and CVE disclosure once verified.