Shapeform is a local-first application. The engine is an offline Python library with no cloud calls and no telemetry, and the web studio is meant to run on your own machine. There is no hosted service and no Shapeform-operated backend, so there is no remote attack surface that we operate on your behalf.

• The web server binds to localhost (127.0.0.1) for personal use. It is not intended to be exposed to a network or the public internet. If you bind it to a non-loopback interface or put it behind a proxy, you take on the responsibility for authenticating and firewalling that surface yourself.
• The main attack surface is file-upload / image parsing. Shapeform decodes raster images and produces SVG using third-party libraries (OpenCV, Pillow, cairosvg/resvg, and friends). Maliciously crafted input files are the most likely vector for a crash or memory-safety issue, generally originating in those upstream decoders. Only feed Shapeform images you trust, especially when running the server.
• Generated SVGs are structured output from your own inputs; as with any SVG, treat files from untrusted sources with care before opening them in a browser.

Please report suspected vulnerabilities privately via GitHub's private security advisories:

Repository → Security tab → Report a vulnerability (GitHub Security Advisories)

Do not open a public issue for a security report. Include enough to reproduce — ideally a minimal input file and the command or steps that trigger the problem, plus your OS and Python version.

We'll acknowledge the report and work with you on a fix and coordinated disclosure. There is no bug bounty — this is a personal-use, open-source project — but credit is gladly given if you'd like it.

For anything that isn't sensitive, a regular GitHub issue is fine.