fix(security): harden sanitize, flatten, redaction, signature validation, CSP, proxies and CI

docs/.vitepress/config.mts

@@ -7,6 +7,7 @@ export default defineConfig({
     description: "Documentation for BentoPDF - The free, open-source, privacy-first PDF toolkit",
     base: '/docs/',
     cleanUrls: true,
+    metaChunk: true,
 
     transformPageData(pageData) {
         const relPath = pageData.relativePath.replace(/\.md$/, '')

docs/self-hosting/cors-proxy.md

@@ -123,7 +123,7 @@ The included Cloudflare Worker has several security measures:
 | **Private IP Blocking** | Blocks IPv4/IPv6 private ranges, link-local, loopback, decimal IPs, and cloud metadata |
 | **Content-Type Safety** | Only returns safe certificate MIME types, blocks upstream content-type injection       |
 | **File Size Limit**     | Streams response with 10MB limit, aborts mid-download if exceeded                      |
-| **Rate Limiting**       | 60 requests per IP per minute (requires KV)                                            |
+| **Rate Limiting**       | 60 requests per minute per IP or IPv6 /64 (requires KV, fails open on KV errors)       |
 | **HMAC Signatures**     | Optional client-side signing (deters casual abuse)                                     |
 
 ### DNS rebinding (self-hosting off Cloudflare)

docs/self-hosting/docker.md

@@ -126,10 +126,11 @@ The nginx image ships with an enforcing `Content-Security-Policy` header. The CS
 As a result:
 
 - If you override `VITE_CORS_PROXY_URL` or `VITE_WASM_*_URL` at build time, the CSP permits those origins automatically — no extra config needed.
-- If you configure custom WASM URLs at _runtime_ via the in-app Advanced Settings page, those origins are **not** in the CSP and the browser will block fetches to them. Runtime configuration is intended for experimentation; for permanent custom URLs set the matching `VITE_*` build arg.
-- Air-gapped deployments that override all three `VITE_WASM_*_URL` values also get the public `cdn.jsdelivr.net` removed from CSP (each default is replaced, not appended). Similarly, setting `VITE_CORS_PROXY_URL` replaces the public `bentopdf-cors-proxy.bentopdf.workers.dev` default.
+- For URLs on `cdn.jsdelivr.net`, `script-src` allows only the exact versioned package folder, for example `https://cdn.jsdelivr.net/npm/@bentopdf/pymupdf-wasm@0.11.16/`, not the whole CDN. jsDelivr serves any public npm package or GitHub repository, so allowing the whole host would let any of them run on your instance. URLs on any other host are allowed by origin.
+- If you configure custom WASM URLs at _runtime_ via the in-app Advanced Settings page, those origins are **not** in the CSP and the browser will block fetches to them. This also applies to a different version of the same package on `cdn.jsdelivr.net`, because only the version set at build time is allowed. Runtime configuration is intended for experimentation; for permanent custom URLs set the matching `VITE_*` build arg.
+- Air-gapped deployments that override all three `VITE_WASM_*_URL` values also get those `cdn.jsdelivr.net` package folders removed from CSP (each default is replaced, not appended). The Tesseract OCR defaults on `cdn.jsdelivr.net` stay in the policy until you also set the three `VITE_TESSERACT_*` values. Similarly, setting `VITE_CORS_PROXY_URL` replaces the public `bentopdf-cors-proxy.bentopdf.workers.dev` default.
 
-The CSP includes `'unsafe-eval'` in `script-src` because the LibreOffice WASM runtime (used by Word/Excel/PowerPoint conversion tools) compiles internal dispatch code via `new Function()`. Removing it would break all LibreOffice-backed tools. If you build in `SIMPLE_MODE` (without LibreOffice), you can manually edit the generated `security-headers.conf` to drop `'unsafe-eval'` for a stricter policy.
+The CSP includes `'unsafe-eval'` in `script-src` because the LibreOffice WASM runtime (used by Word/Excel/PowerPoint conversion tools) and the wasm-vips image library (used by PDF to TIFF) compile internal dispatch code via `new Function()`. Removing it would break those tools. If you build in `SIMPLE_MODE` (without LibreOffice) and do not need PDF to TIFF, you can manually edit the generated `security-headers.conf` to drop `'unsafe-eval'` for a stricter policy.
 
 For OCR, leave the `VITE_TESSERACT_*` variables empty to use the default online assets, or set all three together for self-hosted/offline OCR. Partial OCR overrides are rejected because the worker, core runtime, and traineddata directory must match. For fully offline searchable PDF output, also set `VITE_OCR_FONT_BASE_URL` so the OCR text-layer fonts are loaded from your internal server instead of the public Noto font URLs.
 

docs/tools/edit-pdf.md

@@ -18,7 +18,7 @@ BentoPDF's PDF Editor lets you annotate, highlight, redact, comment, add shapes
 
 - Full annotation toolbar with highlighting, underlining, strikethrough, and freehand drawing
 - Text insertion and commenting
-- Redaction tools for permanently removing sensitive content
+- Redaction tools that permanently remove marked content once you apply the redaction. If any marks haven't been applied when you click **Download Edited PDF**, the editor offers to apply them first.
 - Shape tools for rectangles, circles, lines, and arrows
 - Image insertion onto PDF pages
 - Built-in text search across the document
@@ -37,6 +37,7 @@ BentoPDF's PDF Editor lets you annotate, highlight, redact, comment, add shapes
 
 - You can open multiple PDFs at once and switch between them using the tab bar at the top of the editor.
 - The editor preserves the original PDF structure, so fonts, layouts, and form fields remain intact.
+- Marking text or an area for redaction doesn't remove anything until the redaction is applied. When you redact selected text, copies of it in the file's properties, bookmarks, comments, and attachments are also removed from the download, unless the file is encrypted.
 - For bulk watermarking or page numbering, use the dedicated tools instead for more control over formatting.
 
 ## Related Tools