Security fixes are applied to the latest release on the main branch. Patch releases are back-ported to the current minor series when the vulnerability is rated High or Critical. Older minor series receive no security back-ports.

Xberg is a document-extraction library. Its principal threat is hostile input documents — files crafted to exhaust memory, CPU, or disk, or to exfiltrate data from the calling process.

• Network requests: xberg never makes outbound network requests. =WEBSERVICE(...) formulas and =HYPERLINK(...) cells generate warnings but the URLs are never resolved.
• Macro execution: no VBA, JavaScript, or other macro runtime exists inside xberg. Formula strings are read as data, not evaluated.
• Password-protected documents: encryption is not stripped; protected files are returned with an extraction error.
• Supply-chain / dependency vulnerabilities: report these directly to the dependency maintainer and open a GitHub advisory in this repo so we can update the pinned version.

All limits are on ExtractionConfig.security_limits (SecurityLimits struct) and ExtractionConfig.max_embedded_file_bytes. The defaults are chosen to be permissive enough for legitimate real-world documents while blocking the most common DoS payloads. Set limits to None or very large values only for input you fully trust.

use xberg::{ExtractionConfig, extractors::security::SecurityLimits};

let config = ExtractionConfig {
    // Tighten limits for untrusted input from an upload endpoint.
    security_limits: Some(SecurityLimits {
        max_content_size: 10 * 1024 * 1024,   // 10 MiB output cap
        max_compression_ratio: 50,             // 50× ratio cap
        max_table_cells: 10_000,
        ..SecurityLimits::default()
    }),
    max_embedded_file_bytes: Some(5 * 1024 * 1024), // 5 MiB per embedded file
    extraction_timeout_secs: Some(10),              // 10 s timeout
    ..ExtractionConfig::default()
};

Do not open a public GitHub issue for security vulnerabilities.

Email both maintainers directly:

• Na'aman Hirschfeld — naaman@xberg.io
• Tobias Silva — tobias@xberg.io

You may also use GitHub's private vulnerability reporting on this repository, which opens a private channel with the maintainers.

Include:

1. A description of the vulnerability and affected versions.
2. A minimal reproducer (if possible, a file that triggers the issue).
3. Your assessment of severity (CVSS score or plain description).
4. Whether you want public credit when the advisory is published.

We aim to acknowledge reports within 2 business days and to publish a fix within 14 calendar days for Critical/High issues and 30 days for Medium/Low. We will coordinate disclosure timing with you.

Researchers who follow responsible disclosure will be credited in the GitHub advisory unless they prefer to remain anonymous.

We will not pursue legal action against researchers who:

• Make a good-faith effort to comply with this policy.
• Do not exfiltrate, modify, or destroy data beyond what is necessary to demonstrate the issue.
• Give us a reasonable window to remediate before public disclosure.