Please report security vulnerabilities privately. Do not open a public issue.

Use GitHub's private vulnerability reporting: open the Security tab on the repository and choose Report a vulnerability.

Include:

• A description of the vulnerability and its impact.
• Steps to reproduce (proof-of-concept, affected command, sample archive).
• ArchiveWolf version (archivewolf --version) and your environment.

You can expect an initial acknowledgement within a few days. Once the issue is confirmed and a fix is available, we will coordinate a disclosure timeline with you.

Security fixes are applied to the latest released version. Please upgrade before reporting.

ArchiveWolf is security-research tooling intended for authorized testing only. Reports demonstrating misuse against third-party systems are out of scope.

Emitted hashes contain encrypted archive data (ciphertext, salts, IVs, verification bytes). Handle hashes with the same care as the source archives.