Security fixes are applied to the latest 1.x release and the master branch.

Please use GitHub's private vulnerability reporting for this repository when available. Do not open a public issue containing chat exports, database files, access tokens, personal paths, or other sensitive evidence.

Include the affected version, operating system, a minimal synthetic reproduction, and the expected impact. Replace all real messages and account identifiers with invented values before submitting.

ReadWechatMessage performs offline analysis only. It does not:

• authenticate to WeChat or any cloud service;
• extract or decrypt phone backups or WeChat databases;
• send telemetry, input files, or results over the network;
• execute spreadsheet formulas;
• include third-party executables or archives.

The project accepts only CSV and XLSX files supplied by the user. Keep those files outside the repository. Local configuration, common chat export formats, databases, result directories, and recovery bundles are ignored by Git.

Input files can still be untrusted. Run the tool as a normal user, keep dependencies locked, and do not disable validation for files from unknown sources.