We provide security updates for the latest version of PPT Master.
| Version | Supported |
|---|---|
| Latest | Yes |
| Older | No |
Please do not report security vulnerabilities through public GitHub Issues.
If you discover a security issue, please report it privately by emailing:
Include in your report:
- A description of the vulnerability
- Steps to reproduce the issue
- The potential impact
- Any suggested fix, if you have one
We will acknowledge your report within 72 hours and aim to provide a resolution timeline within 7 days.
This policy covers the PPT Master source code in this repository, including:
- Python scripts in
skills/ppt-master/scripts/ - Post-processing pipeline (
total_md_split.py,finalize_svg.py,svg_to_pptx.py) - Project management utilities
Out of scope:
- Third-party AI editors or APIs (Claude, Cursor, GitHub Copilot, etc.)
- Generated PPTX output files
- User-provided source documents
We follow responsible disclosure. Once a fix is available, we will publish a GitHub Security Advisory crediting the reporter (unless they prefer to remain anonymous).
Thanks to the researchers who reported issues privately:
- Zick Sun — case-sensitivity bypasses in the live preview SVG sanitizer and attribute injection in
embed_icons.py(fixed in v6.3.1), plus the follow-up hardening shipped in v6.3.2.