Information about NullifyPDF's security model, privacy boundaries, and how to report security vulnerabilities.

NullifyPDF follows a privacy-first architecture:

❌ No Cloud Uploads During PDF Processing
❌ No Data Collection (no logs sent anywhere)
❌ No Third-party Processing APIs (analysis runs locally)
❌ No User Accounts (no registration required)
❌ No Tracking (no cookies, no analytics)

When you export a PDF with redactions:

1. ✅ Metadata Stripped — Creation date, author, and document metadata removed
2. ✅ Links Removed When Redacted — Links overlapping redaction areas are deleted
3. ✅ Redactions Applied — Selected text/image areas are removed from the exported PDF
4. ✅ Pseudonymization Maps Encrypted — Restore maps are stored separately and encrypted with a user password

During export, NullifyPDF uses disk-backed temporary files:

• Temporary data written to system temp directory
• Automatically cleaned up after export completes
• On Windows: %APPDATA%\Local\Temp\
• On macOS/Linux: /tmp/

• Original PDF kept in memory only while open
• AI results (detected entities) stored only in-memory during session
• Exported PDF overwrites original data locations
• Graceful cleanup on app close

• ✅ PDF files only (blocked: .exe, .zip, etc.)
• ✅ Password-protected PDFs are blocked before processing
• ✅ Encryption detection (blocks password-protected PDFs)
• ✅ Extension and existence checks before opening PDFs

• ✅ Page number bounds checking
• ✅ Language selection validation (EN/IT/BOTH only)
• ✅ File path sanitization
• ✅ Type hints on all functions

Do NOT open a public GitHub issue. Instead, follow these steps:

1. Assess the Risk

   • Is it a privacy leak? (severity: HIGH)
   • Is it a data corruption risk? (severity: HIGH)
   • Is it a UI bug? (severity: LOW)

2. Report Through Proper Channel

   • Open a private security advisory on GitHub, OR
   • Contact through GitHub security form (coming soon)

3. What to Include

   • Detailed vulnerability description
   • Steps to reproduce
   • Affected version(s)
   • Suggested fix (if you have one)
   • Your name (if you want credit)

4. Timeline

   • You'll receive acknowledgment within 48 hours
   • Fix will be attempted within 2 weeks (critical) or 1 month (standard)
   • You'll be credited in release notes

We follow responsible disclosure principles:

• Embargo Period: 30 days for critical vulnerabilities
• Public Disclosure: After patch is released
• Credit: Security researchers credited by name (unless anonymous requested)

Only the latest released version receives security updates. Always use the newest version for security patches and critical fixes.

1. Shoulder Surfing — If someone watches your screen while redacting
2. Malware on Your Computer — If your machine is compromised
3. Unencrypted Storage — Save your PDF to an encrypted drive if sensitive
4. Physical Access — If someone accesses your hard drive directly
5. Residual PDF Artifacts — Complex PDFs may contain structures not covered by automated checks

• 🔒 Use encrypted storage (BitLocker, FileVault, LUKS)
• 🛡️ Keep antivirus software updated
• 🔑 Use strong passwords on your machine
• 🚫 Don't share exported PDFs on unsecured channels
• 🔄 Use trusted networks when processing sensitive documents

The codebase is open source and welcomes security audits:

• Review code on GitHub
• Check NullifyPDF.py for data handling
• Review ARCHITECTURE.md for system design
• Examine test coverage in tests/

We use Python static analysis tools:

# Type checking
mypy NullifyPDF.py

# Linting
pylint NullifyPDF.py

# Security scanning
bandit NullifyPDF.py

Security-relevant tests cover:

• Input validation smoke tests
• Resource cleanup (file handles, memory)
• Privacy-core and build-configuration tests

Run tests:

pytest tests/ -v

Your redaction preferences (blocklist/allowlist) are stored locally:

• ✅ Only accessible by your user account
• ✅ Not synced to cloud
• ✅ Not shared with anyone
• ✅ Deleted when you remove files

The application relies on the operating system's standard user permissions for ~/.nullifypdf/. Store sensitive files on encrypted storage when required.

NullifyPDF uses trusted, actively-maintained libraries:

We monitor dependencies for CVEs:

• GitHub Dependabot alerts enabled
• Security updates applied promptly
• Community reports welcomed

NullifyPDF is provided as-is without warranty. While we take security seriously:

• No Guarantee of Unrecoverability — For highly sensitive data, consult legal/security experts
• No Liability — Use at your own risk
• Not a Legal Tool — Consult lawyers for document redaction in legal cases
• Residual Risk — For highly sensitive or legally critical documents, perform independent review and validation

For mission-critical or legal redactions, consider:

• Professional redaction services
• Dedicated security appliances
• Expert legal guidance

We acknowledge and credit security researchers who responsibly disclose vulnerabilities:

• [List of past security fixes and contributors]
• (Updates as vulnerabilities are resolved)

For security vulnerabilities only:

• GitHub Security Advisory (coming soon)
• OR check GitHub repository for security contact

• 📖 See README.md
• 💬 Open GitHub Discussion
• 🐛 Report bugs on GitHub Issues

• OWASP Security Best Practices
• Python Security
• PII Protection Guide

Last updated: 2026-07-23
← Contributing | Back to README →