Please report security vulnerabilities by opening a private GitHub Security Advisory at: https://github.com/CrossApplication/glyph_path_flutter/security/advisories/new

Do not open a public issue for security vulnerabilities.

This package has no binary-parsing attack surface of its own — toUiPath() only translates an already-parsed TextPathResult (produced by glyph_path) into a dart:ui Path via the Flutter SDK's own Path API. Untrusted font data should be treated as untrusted at the glyph_path boundary; see glyph_path's SECURITY.md for that package's resource limits and parsing-safety guarantees.

The only non-SDK dependency is glyph_path itself. To re-verify at each dependency update, search for advisories at osv.dev, check the package changelog on pub.dev, and run dart pub outdated to identify stale versions. GitHub Dependabot is configured (.github/dependabot.yml) for automatic advisory notifications.