Word Office is under active development. Security fixes are applied to the main branch and included in the latest nightly builds.

We take security seriously. If you discover a vulnerability, please report it responsibly.

Do not open a public issue for security vulnerabilities.

Instead, please report vulnerabilities by:

1. Email: Contact the Word Office security team via the Codeberg organization or through one of the contributing partner organizations.
2. Private vulnerability reporting: Use Codeberg's private vulnerability reporting feature if available.

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes (if available)

• We will acknowledge receipt within 7 days
• We will aim to provide an initial assessment within 14 days
• We will keep you informed of progress toward a fix
• We will credit you in the fix disclosure (unless you prefer anonymity)

• Keep deployments updated: Subscribe to the repository releases and update promptly.
• Review access controls: Ensure DocumentServer is not publicly accessible without authentication.
• Use HTTPS: Always serve Word Office over HTTPS in production.
• Docker security: Keep Docker and the host system updated. Review container permissions.

Word Office uses automated security scanning via Forgejo Actions CI. Report suspicious dependencies via the vulnerability reporting channels above.