Security fixes target the latest release and the current main branch.

The project intentionally supports only public HTTPS URLs whose host is exactly mp.weixin.qq.com. Redirects are validated against the same boundary. The reader sends no cookies, account credentials, API keys, or browser session data.

Each invocation is bounded to one desktop request and one WeChat WebView retry. Verification pages are detected and reported; the project does not rotate proxies, enumerate identities, solve CAPTCHA, replay tokens, or bypass authentication and paywalls.

Article HTML and extracted text are treated as untrusted data. Embedded instructions never override the user's request or Agent policy. Markdown output accepts only HTTPS links, and embedded images are restricted to known WeChat CDN hosts; credential-bearing and active or local URL schemes are rejected.

Report suspected security vulnerabilities through GitHub private vulnerability reporting. Do not open a public issue for a vulnerability or include live credentials, private article content, cookies, or personal browsing data in a report.

Useful reports include a minimal public URL or synthetic fixture, the affected version or commit, expected behavior, observed behavior, and a proposed mitigation when available.