Information about NullifyPDF's security model, privacy guarantees, and how to report security vulnerabilities.

NullifyPDF follows a privacy-first architecture:

❌ No Internet Connections (except GitHub release checks)
❌ No Data Collection (no logs sent anywhere)
❌ No Third-party APIs (everything local)
❌ No User Accounts (no registration required)
❌ No Tracking (no cookies, no analytics)

When you export a PDF with redactions:

1. ✅ Metadata Stripped — Creation date, author, embedded text removed
2. ✅ Links Destroyed — Hyperlinks and form fields eliminated
3. ✅ Binary Scrubbing — Text beneath redactions overwritten at binary level
4. ✅ Forensically Sound — Redacted data is unrecoverable

During export, NullifyPDF uses disk-backed temporary files:

• Temporary data written to system temp directory
• Automatically cleaned up after export completes
• On Windows: %APPDATA%\Local\Temp\
• On macOS/Linux: /tmp/

• Original PDF kept in memory only while open
• AI results (detected entities) stored only in-memory during session
• Exported PDF overwrites original data locations
• Graceful cleanup on app close

• ✅ PDF files only (blocked: .exe, .zip, etc.)
• ✅ File size limits to prevent DOS attacks
• ✅ Encryption detection (blocks password-protected PDFs)
• ✅ Path traversal protection (prevents ../../../etc/passwd exploits)

• ✅ Page number bounds checking
• ✅ Language selection validation (EN/IT/BOTH only)
• ✅ File path sanitization
• ✅ Type hints on all functions

Do NOT open a public GitHub issue. Instead, follow these steps:

1. Assess the Risk

   • Is it a privacy leak? (severity: HIGH)
   • Is it a data corruption risk? (severity: HIGH)
   • Is it a UI bug? (severity: LOW)

2. Report Through Proper Channel

   • Open a private security advisory on GitHub, OR
   • Contact through GitHub security form (coming soon)

3. What to Include

   • Detailed vulnerability description
   • Steps to reproduce
   • Affected version(s)
   • Suggested fix (if you have one)
   • Your name (if you want credit)

4. Timeline

   • You'll receive acknowledgment within 48 hours
   • Fix will be attempted within 2 weeks (critical) or 1 month (standard)
   • You'll be credited in release notes

We follow responsible disclosure principles:

• Embargo Period: 30 days for critical vulnerabilities
• Public Disclosure: After patch is released
• Credit: Security researchers credited by name (unless anonymous requested)

Only the latest released version receives security updates. Always use the newest version for security patches and critical fixes.

1. Shoulder Surfing — If someone watches your screen while redacting
2. Malware on Your Computer — If your machine is compromised
3. Unencrypted Storage — Save your PDF to an encrypted drive if sensitive
4. Physical Access — If someone accesses your hard drive directly
5. Forensic Recovery — If sophisticated attackers do disk forensics

• 🔒 Use encrypted storage (BitLocker, FileVault, LUKS)
• 🛡️ Keep antivirus software updated
• 🔑 Use strong passwords on your machine
• 🚫 Don't share exported PDFs on unsecured channels
• 🔄 Use trusted networks when processing sensitive documents

The codebase is open source and welcomes security audits:

• Review code on GitHub
• Check NullifyPDF.py for data handling
• Review ARCHITECTURE.md for system design
• Examine test coverage in tests/

We use Python static analysis tools:

# Type checking
mypy NullifyPDF.py

# Linting
pylint NullifyPDF.py

# Security scanning
bandit NullifyPDF.py

Security-relevant tests cover:

• Input validation (path traversal, injection)
• Resource cleanup (file handles, memory)
• Permission handling (file mode, ownership)

Run tests:

pytest tests/ -v

Your redaction preferences (blocklist/allowlist) are stored locally:

• ✅ Only accessible by your user account
• ✅ Not synced to cloud
• ✅ Not shared with anyone
• ✅ Deleted when you remove files

On Linux/macOS, directory permissions default to:

drwx------  user  group  .nullifypdf/

Only your user can read/write. On Windows, standard user ACLs apply.

NullifyPDF uses trusted, actively-maintained libraries:

We monitor dependencies for CVEs:

• GitHub Dependabot alerts enabled
• Security updates applied promptly
• Community reports welcomed

NullifyPDF is provided as-is without warranty. While we take security seriously:

• No Guarantee of Unrecoverability — For highly sensitive data, consult legal/security experts
• No Liability — Use at your own risk
• Not a Legal Tool — Consult lawyers for document redaction in legal cases
• Forensic Limitations — Determined attackers with forensic tools may recover data

For mission-critical or legal redactions, consider:

• Professional redaction services
• Dedicated security appliances
• Expert legal guidance

We acknowledge and credit security researchers who responsibly disclose vulnerabilities:

• [List of past security fixes and contributors]
• (Updates as vulnerabilities are resolved)

For security vulnerabilities only:

• GitHub Security Advisory (coming soon)
• OR check GitHub repository for security contact

• 📖 See README.md
• 💬 Open GitHub Discussion
• 🐛 Report bugs on GitHub Issues

• OWASP Security Best Practices
• Python Security
• PII Protection Guide

Last updated: 2026-06-06
← Contributing | Back to README →