Skip to content

Security: yoursmilestar-ctrl/chart-revive

Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Version

Security fixes target the latest released version.

Report a Vulnerability

Before the repository is public, report vulnerabilities privately to the maintainer through GitHub's private vulnerability reporting after it is enabled. Do not include secrets, confidential charts, or personal data in a public issue.

Security Boundaries

  • The CLI reads local JSON and image files and writes local PPTX, CSV, PNG, JSON, and HTML files.
  • It makes no network requests and executes no content from the source image or manifest.
  • Generated PowerPoint files contain no macros or external workbook links.
  • CSV text fields that could be interpreted as formulas are prefixed with an apostrophe.
  • Native chart labels receive a visually invisible prefix before the embedded workbook is created, preventing formula interpretation without changing the displayed label.
  • HTML output is self-contained and contains no scripts, remote fonts, or CDN assets.

A clean scan cannot prove that every future chart or dependency is safe. Keep dependencies updated and review generated files before distributing them.

There aren't any published security advisories