This project is pre-1.0 (0.x) and under active development. Security fixes are applied to the latest main and the most recent release only. There are no long-term-support branches yet.

Please do not report security vulnerabilities through public GitHub issues.

Instead, use GitHub's private vulnerability reporting:

1. Go to the repository's Security tab.
2. Click Report a vulnerability to open a private advisory.

This lets us discuss and fix the issue before any public disclosure.

When reporting, please include as much of the following as you can:

• A description of the vulnerability and its impact.
• Steps to reproduce (ideally a minimal ODX/PDX input or unit test).
• The affected version / commit.

Please do not include real vehicle diagnostic data in reports. Use a minimized, synthetic reproducer.

This library parses ODX/PDX files, which may come from untrusted sources. The most security-relevant surface is therefore the parsing and decoding path (io/, codec/, dd/, parameter/). Examples of in-scope reports:

• Crashes, unbounded memory/CPU use, or hangs triggered by crafted ODX/PDX input.
• XML parsing weaknesses (e.g. XXE / entity expansion) when reading documents or performing optional XSD schema validation.
• Path traversal or zip-related issues when reading PDX archives.

We aim to acknowledge reports promptly and will keep you informed of progress toward a fix. Thank you for helping keep users safe.