Security issues include command execution, path handling, unsafe HTML output, unexpected network access, disclosure of source code, and denial of service from a crafted patch.

• EarPatch makes no network requests and has no telemetry.
• Git is invoked with an argument array and shell=False.
• Git is resolved from absolute PATH directories outside the current working directory, preventing a repository-local git.exe from taking precedence.
• External Git diff helpers, text-conversion drivers, and the pager are disabled.
• A revision that starts with - or contains a control character is rejected.
• Patch content and paths are HTML-escaped.
• Terminal and bidirectional-formatting controls are rendered as visible labels.
• Inputs are limited to 10 MB by default, and Git has a 30-second timeout.
• Output files are written only when the user supplies --output. Existing paths require --force and are replaced atomically without following a symbolic link.

Treat patch files as untrusted data. EarPatch does not execute patch content. For bulk workloads, set a smaller --max-bytes value when possible.

Git mode is different: Git can run content filters from .git/config while it reads a working tree. EarPatch disables external diff helpers, text conversion, and fsmonitor, but cannot generically disable every named content filter without changing the patch. For this reason Git mode requires --trust-repository. For an untrusted repository, obtain a patch in a sandbox and give that patch to EarPatch as a file or through standard input.

Until a public repository has a private reporting channel, do not publish an unfixed vulnerability. Send a minimal report directly to the repository owner. Do not attach real private source code; use a synthetic reproducer.