Please report security issues privately through GitHub's private vulnerability reporting feature on this repository's Security tab, rather than opening a public issue. This lets us assess and fix the issue before details are public.

We don't commit to a fixed response or fix timeframe, but we will acknowledge reports and keep you updated as we investigate.

text_morph_flutter is a Flutter UI package: it parses font outlines (via glyph_path) and vector paths, interpolates them, and paints the result with dart:ui/Canvas. It does not perform any networking, spawn subprocesses, read environment variables, or handle credentials — the realistic categories of report are:

• A crafted font or path input causing a crash, hang, or excessive memory/CPU use during morphing (e.g. degenerate contours, extreme vertex counts).
• Any other input that this package processes on the caller's behalf triggering unexpected or unsafe behavior.

• Partial bidirectional (Unicode Bidi / UAX #9) text support. Morph defaults to left-to-right glyph order; TextSource.rtlScript and TextSource.embedLtr are opt-in, manual affordances for non-cursive scripts (e.g. Hebrew) only — cursive/joining scripts (Arabic, Farsi, Urdu) are not supported. This is a documented limitation (see README.md#known-limitations), not a vulnerability.
• Performance degradation on inputs far outside typical UI text/shape sizes (very long strings, very high-vertex shapes) — see README.md#known-limitations for the documented ceilings and fallbacks.