Security fixes are provided for the latest tagged release.

Use GitHub's private vulnerability reporting for KanadeK/windowray. Do not open a public issue containing an exploit, private location data, or other sensitive scenario content.

WindowRay is offline and runtime dependency-free. The application makes no network calls, launches no subprocesses, loads no plugins, executes no user code, and emits no telemetry.

The untrusted boundary is local JSON plus user-selected input/output paths. Inputs receive UTF-8/JSON, exact-field, type, finite-number, range, geometry, size, and workload validation. HTML/XML user strings are escaped; CSV is emitted through Python's standard library. Existing report artifacts are not overwritten without --force, which targets only four fixed names.

Unexpected errors intentionally fail with a traceback rather than being swallowed. This makes implementation defects observable during CI and local verification.