Security policy for tc-lib-pdf, a pure-PHP library for generating PDF documents.

Security fixes are applied only to the latest stable release on the main branch.

Do not open a public GitHub issue for security vulnerabilities.

1. Email the maintainer at info@tecnick.com with the subject line:
   [SECURITY] tc-lib-pdf - <brief description>
2. Include the details listed under What to Include.
3. An acknowledgement follows, then a fix or mitigation.

If you receive no response, reply to the same email thread.

• Description: summary of the vulnerability and its impact.
• Affected component: the class, method, or feature involved.
• Steps to reproduce: a minimal, self-contained PHP script or unit test.
• Expected vs. actual behaviour.
• Environment: PHP version, OS, library version (output of composer show tecnickcom/tc-lib-pdf).
• CVE / CWE reference (optional).
• Suggested fix (optional): a patch or proposed mitigation.

tc-lib-pdf processes HTML, CSS, SVG, fonts, and images that may originate from untrusted sources. Sanitise input before passing it to the library:

• Validate and sanitise all user-supplied HTML/CSS before rendering. Use a dedicated HTML sanitiser (for example HTML Purifier) for content from end users.
• Restrict external asset loading. Use fileOptions['allowedHosts'] to allow only trusted remote domains, and set fileOptions['allowedPaths'] when you need to narrow local file reads to specific asset directories. If you override allowedPaths, include every required local root because it replaces the defaults.
• Limit file-system access. Run the PDF-generation process with the minimum required filesystem permissions. Never pass raw user input as a file path.
• Keep dependencies up to date. Run composer update regularly and monitor advisories via Packagist Security Advisories or tools such as composer audit.
• Pin versions in production. Use composer.lock and review changes on every update.