Security

PrintLint is designed as an offline validator. It does not fetch URLs from input files, execute markup, run OCR, or use calendar references at runtime.

SVG validation rejects DTD/entity declarations and identifies scripts, event handlers, foreignObject, remote resource attributes, and external CSS. PDF validation reads document metadata and page boxes through pypdf; it does not render pages or execute embedded content. Avoid passing secrets or private documents to CI jobs where logs and artifacts are visible to others.

Report suspected vulnerabilities using the repository's private security advisory form. See the repository security policy for the response policy.