tmaudit is a local-only audit tool that reads your LaTeX source files and reports findings. It does not:

• Make network requests.
• Read files outside the directories you specify.
• Execute the audited LaTeX (compile is a separate opt-in step that requires explicit user confirmation).

Because of this limited attack surface, the security risk profile is lower than for a typical CLI tool. However, the audit logic itself is security-sensitive: a bug that causes tmaudit to silently miss a finding is effectively a way to hide a real paper bug from the author. We treat such bugs as security issues and follow the disclosure process below.

Please do NOT file a public issue for security vulnerabilities.

Use one of these private channels:

1. GitHub Security Advisories (preferred): github.com/aidless/tmaudit/security/advisories/new
2. Email: security@tmaudit.example (PGP key in .gpg/ if you need it; this is a placeholder address for the template repo).

Please include:

• A description of the vulnerability and its impact.
• A minimal reproduction (paper directory + command).
• The tmaudit version, Python version, and OS.
• Whether you are willing to be credited in the advisory.

• Audit bypass: a way to make tmaudit report 0 findings on a paper that actually has a C1..C6 violation. (This is why the meta-test in _check_all_regressions.py exists.)
• Path traversal: a way to make tmaudit read files outside the paper directory.
• Code execution: a way to make tmaudit execute arbitrary code via a malicious .tex or .bib file.
• Information disclosure: a way to leak the user's file system layout (e.g., /home/user path) in the audit output.
• Dependency vulnerability: a known CVE in a runtime dependency (e.g., pyyaml, regex).

• A false positive in the audit (the audit reports a finding where there is no real bug). File a regular bug report.
• A paper that fails the audit. Edit your paper; do not open a security advisory.
• A feature request for a new audit category. Use the feature request template.

The following items have security implications; please review them before deployment:

We thank the following reporters (alphabetical by GitHub username; updated after each disclosure):