# Security policy

## Product boundary

Version 0.2 remains for synthetic data only. Open-source distribution does not make patient data public and does not authorize real patient processing. Do not submit real medical documents or credentials in bug reports, screenshots, test fixtures, filenames, logs, or repository issues.

## Reporting a vulnerability

Report the software version, operating system, steps to reproduce, and a synthetic reproducer. Never attach an original medical document. A public security-reporting address controlled by NPO NT must be approved before external binary release.

## Release-blocking classes

- Source content in logs, crash reports, filenames, or analytics
- Recoverable redacted PDF content
- Original metadata, attachment, annotation, form, or JavaScript copied to output
- Network transmission before explicit user confirmation
- Unsigned or unverifiable updater
- Unhandled encrypted, malformed, or oversized input
- Missing required OCR or barcode capability presented as a successful check
