Please report vulnerabilities privately using GitHub's Private Vulnerability Reporting (the repository's Security tab → Report a vulnerability), if it is enabled for this repository. Please do not open a public issue for a suspected vulnerability.

Include the affected version, your environment (kernel, Bubblewrap version, PHP version), and a minimal reproduction. Use only generated canary files in reproductions, never real secrets.

In scope: the code in this repository — sandbox construction, workspace handling, symlink/path handling, environment scrubbing, limits and timeouts, fail-closed behaviour.

Out of scope: vulnerabilities in Bubblewrap, the Linux kernel, PHP, or third-party binaries you choose to run.

Do not test security issues against the live pdf-x.co production service. Test only on your own systems using this library.

Only the latest release receives security fixes.