PDFSeal is built on an uncompromising principle: Your documents never leave your machine.
- All PDF parsing, manipulation, rendering, OCR, compression, encryption, and signing are performed strictly inside your browser's local sandbox memory (
ArrayBuffer/ WebAssembly / Canvas). - PDFSeal has no backend processing servers.
- PDFSeal uses no third-party tracking cookies and transmits no user files over the wire.
Only the latest release running on the official domain pdf.sealkit.org and the latest commit on main branch are actively supported with security updates.
| Version | Supported |
|---|---|
Latest main / pdf.sealkit.org |
✅ |
Self-hosted Docker :latest |
✅ |
| Older revisions | ❌ |
We take the security and privacy of our users extremely seriously. If you discover a security vulnerability, please follow responsible disclosure guidelines:
- Do NOT open a public GitHub issue describing the vulnerability.
- Please privately disclose the issue via GitHub's Private Security Advisories or send an email to security@sealkit.org.
- Include detailed steps to reproduce the vulnerability, including browser version, environment, and proof of concept.
- Inadvertent network leakages (e.g. any code path that could transmit document data or metadata externally).
- Cross-Site Scripting (XSS) within the browser sandbox.
- Prototype pollution or arbitrary code execution vectors in client-side PDF parsers.
- WebCrypto key leakage in Vault or P2P transfer modules.
We strive to acknowledge all reports within 48 hours and provide a timeline for remediation. Thank you for keeping PDFSeal secure! 🐟