Report a security vulnerability

How to report

• Email security@wolfie.gg.
• For the public open-source editions, GitHub private vulnerability reporting is an equivalent channel on wolfiesch/wolfppt-oss (WolfPPT) and SynthGL/wolfxl-oss (WolfXL Community).
• Do not open public issues for suspected security problems or for corrupt output.
• Machine-readable contact details are published at /.well-known/security.txt.

What to include

• The Wolf version, from wolf --version, or the package name and version.
• The platform.
• The command or API call that triggers the problem.
• A minimal reproducing document where possible.

Response expectations

• Reports are acknowledged within 7 days.
• WolfPPT reports are acknowledged within 3 business days.

In scope

The published WolfXL, WolfPPT, and WolfDocx packages, the wolf CLI and its drop-in shims, and the Wolf product websites. Reports about documents and the runtime include these categories:

• Memory-safety faults, panics, hangs, or unbounded memory or CPU use triggered by a document, including zip bombs, decompression bombs, XML entity expansion, and deeply nested structures.
• XML external entity resolution, DTD processing, or any fetch of a URL, UNC path, or file named inside a document.
• Path traversal or a write outside the requested output location during save, convert, render, or extract.
• Changes to package parts that the requested operation did not touch.
• Network access, subprocess execution, or macro execution by the wolf binary or a shim.
• Command or argument injection through the shims or the agent CLI.
• A receipt or omission report that misstates what was rendered, calculated, or converted.

Out of scope

• Rendering or layout fidelity differences that do not corrupt a file or misreport a receipt.
• Resource use proportional to a large but well-formed document when the caller set no budget.
• Behavior of third-party tools that Wolf compares against or that a caller runs beside it.
• Executing embedded VBA macros. WolfPPT preserves macro parts byte-for-byte as opaque data and never interprets them.

Runtime behavior and known gaps

• The embedded Wolf binary has no network client, runs no subprocess, interprets no macros, and resolves no external references. A report that shows any of these happening is in scope.
• Wolf makes no network requests and collects no telemetry.
• Hardened-parser limits currently apply on the XLSX patch path only. Treat PPTX, DOCX, ODF, and PDF input from untrusted sources as able to exhaust memory or CPU, and run Wolf under operating-system resource limits.

Trust material

Procurement and security reviewers can start with the vendor packet and the published trust documentation.