Use GitHub private vulnerability reporting. Include:

• affected version and platform;
• minimal reproduction using generated or redistributable input;
• impact and trust-boundary assumptions;
• suggested mitigation if known.

Do not open a public issue before a fix or coordinated disclosure.

GlyphRoute:

• reads local text and binary font files;
• writes reports and optional subset fonts to user-selected paths;
• makes no network requests during a scan;
• does not execute font code, macros, localization expressions, or source scripts;
• does not claim that fontTools parsing is a sandbox.

Treat untrusted fonts as hostile binary input. Analyze them inside a disposable container/VM with no secrets and a read-only input mount. Do not run the GitHub Action on untrusted pull requests with write-capable tokens or sensitive self-hosted runners.

Reports intentionally omit full messages, absolute roots, and font bytes, but relative filenames and individual characters may still be sensitive. Apply the repository's artifact retention policy.

The project aims to acknowledge a complete report within seven days, assess severity, prepare a fix and regression fixture, and coordinate disclosure. This is a best-effort open-source target, not a service-level agreement.