We take security vulnerabilities seriously. If you discover a security issue in PrintBridge, please follow these steps:

Security vulnerabilities should not be disclosed publicly until a fix is available.

Email: sbia.anouar@gmail.com

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Acknowledgment: within 48 hours
• Initial assessment: within 5 business days
• Fix or mitigation: within 30 days (severity-dependent)
• Public disclosure: after fix is released, coordinated with reporter

PrintBridge runs locally on 127.0.0.1 and does not expose external endpoints. Security concerns include:

• CORS misconfiguration allowing unauthorized origins
• Input validation bypasses in API endpoints
• Path traversal in file handling
• Privilege escalation via auto-start registration

• Vulnerabilities in dependencies (report to upstream projects)
• Social engineering attacks
• Physical access to the machine running PrintBridge
• DoS attacks requiring local network access

1. Keep CORS restricted — only add your web app's domain to cors_origins
2. Don't expose the port — PrintBridge binds to 127.0.0.1 only, keep it that way
3. Review config.json — ensure no sensitive data in config files
4. Keep dependencies updated — run pip install --upgrade -r requirements.txt periodically