Security fixes are applied to the latest 0.1.x release.
WickBench accepts untrusted local CSV/JSON and caller-chosen output paths. It does not make network requests, load plugins, evaluate formulas, execute input, or run a shell. Numeric input must be finite. Candidate identifiers must be printable; JSON encoding and Markdown/SVG escaping keep identifiers from becoming active output content.
The CLI intentionally overwrites report paths supplied by the caller. Treat
--output and --chart like normal output-file arguments and do not point them
at files you need to preserve.
WickBench reports arithmetic against limits supplied by the user. A passing report is not a fire-safety, regulatory, quality, or product-certification verdict. The tool does not prescribe how to run a live burn test.
Open a private GitHub security advisory at
https://github.com/KanadeK/wickbench/security/advisories/new. Include the
smallest reproducer, affected command, expected boundary, and observed impact.
Do not include proprietary formulas or customer data in a public issue.