ANVIL runs entirely on your machine — it makes no network calls, has no telemetry, and reads only the input you give it. That keeps its attack surface small, but if you find a security issue, we want to hear about it.

Please report security issues privately rather than opening a public issue:

• Email: info@neatlabs.ai
• Point of contact: Randy B. — NEATLABS (https://neatlabs.ai)

Include a description, reproduction steps, and the affected version (anvil/core.py → ANVIL_VERSION). We aim to acknowledge reports promptly and will coordinate a fix and disclosure timeline with you.

• ANVIL performs static decoding/parsing. It does not execute input (for example, decoded PowerShell is shown as text, never run).
• Treat untrusted input as untrusted: decoding a malicious sample is safe, but act on the results (e.g. extracted URLs) with normal caution.

The latest released version receives fixes. Please upgrade before reporting.