| Version | Supported |
|---|---|
| 0.16.x | Yes |
Only the latest release receives security patches. Once HwpForge reaches 1.0, this table will expand to cover the last two minor releases.
Do not open a public issue for security vulnerabilities.
Instead, please report them privately:
- GitHub Security Advisory (preferred) — Go to Security Advisories and create a new draft advisory.
- Email
— Send details to hanyul.ryu@hanyul.xyz with the subject line
[HwpForge Security].
- A description of the vulnerability and its impact.
- Steps to reproduce or a proof of concept.
- Affected crate(s) and version(s).
- Any suggested fix, if you have one.
- Acknowledgement within 48 hours of your report.
- Triage and severity assessment within 7 days.
- A fix coordinated privately before public disclosure. We aim to release a patch within 30 days of confirming the issue.
- Credit in the release notes (unless you prefer to remain anonymous).
HwpForge is a document processing library. The following are in scope:
| Area | Examples |
|---|---|
| Memory safety | Buffer overflows, use-after-free (note: #![deny(unsafe_code)] is declared in the core crates — see Security Measures below) |
| Input parsing | ZIP bombs, XML entity expansion, malformed HWPX/HWP5 causing panics or hangs |
| Path traversal | Malicious ZIP entries writing outside the target directory |
| Denial of service | Crafted inputs causing unbounded memory or CPU consumption |
| Dependency issues | Known CVEs in transitive dependencies |
Out of scope: issues in the Hancom 한글 application itself, or issues that require the attacker to already have arbitrary code execution on the host.
HwpForge employs the following safeguards:
#![deny(unsafe_code)]declared inhwpforge-core,hwpforge-foundation,hwpforge-blueprint,hwpforge-smithy-hwpx,hwpforge-smithy-md, andhwpforge-smithy-hwp5. The remaining six crates (hwpforge,hwpforge-convert,hwpforge-bindings-py,hwpforge-bindings-cli,hwpforge-bindings-mcp,hwpforge-smithy-pdf) do not declare the attribute, but contain nounsafecode either — the workspace has zero unsafe blocks in total.- ZIP bomb defense — 50 MB per entry, 500 MB total, 10,000 entry limit.
cargo-deny— license and advisory audits run in the CI merge queue (not on every PR) and in the weekly advisory scan.- Dependabot — automated dependency update PRs.
- Nightly canary — weekly beta/nightly toolchain builds catch regressions early.
We follow coordinated disclosure. After a fix is released, the advisory will be published with full details and credit to the reporter.