# Security Policy

`nirs4all-formats` parses untrusted binary and text files. Readers must fail closed.

## Runtime Rules

- Bound all reads and decompression.
- Reject archive path traversal, absolute paths, symlinks and device files.
- Preserve native values but report NaN/Inf and non-monotonic axes.
- Never execute vendor macros or embedded scripts.
- Treat GPS, operator names, serial numbers and comments as potentially
  sensitive metadata.

## Reporting

Before public releases, report issues directly to the maintainer. After the
GitHub repository is public, use GitHub private vulnerability reporting if
enabled.