Please do not open a public issue for a security problem.

Report it privately through GitHub: Report a vulnerability (repository → Security → Advisories → Report a vulnerability).

That opens a private advisory visible only to you and the maintainers, needs no infrastructure on either side, and gives us somewhere to discuss a fix and issue a CVE if one is warranted.

If the advisory form is unavailable to you, open a public issue saying only that you have a security report and how to reach you — no details — and a maintainer will arrange a private channel.

The more of this you can provide, the faster a fix lands:

• what an attacker achieves, and what access they need to start
• affected versions, plus the platform and Python version you saw it on
• a reproduction — a script, or the commands you ran
• anything you already know about the cause or a possible fix

PixelRAG renders untrusted documents and web pages and serves retrieval over the result, so the interesting boundaries are where untrusted input meets execution:

• pixelshot capture — a headless Chrome/CDP process pointed at attacker-controlled pages. Sandbox escapes, navigation to local or internal addresses, and anything that escalates from page content to host access.
• Tiles as model input — a tile is a screenshot of a page we did not write. Text inside it reaching a model as instructions rather than data is in scope, including via the pixelbrowse plugin, which grants Bash.
• The index pipeline — path traversal, symlink following, and archive extraction when ingesting local files or crawled content.
• The serve API — /search, /reconstruct, /tile and the on-demand render path: unbounded work per request, reads outside the tile directory, or leaking host paths.
• Credentials — API keys and endpoints for third-party readers configured in eval/.

Out of scope: findings against a deployment you have deliberately exposed to a network (for example an embedding server bound beyond loopback and reachable from the internet), and vulnerabilities in third-party dependencies that are already public — report those upstream, though we do want to know if PixelRAG pins an affected version.

Fixes land on main and ship in the next release. If you are on an older release, please confirm the issue reproduces on current main where you can.

We will confirm receipt, keep you updated as we investigate, and credit you in the advisory unless you would rather stay anonymous. Please give us a reasonable window to ship a fix before disclosing publicly.