MermaidGuard parses Markdown files from your local filesystem. It uses remark and unified, which are industry-standard, safe parsers.

• Risk: Malformed Markdown causing ReDoS (Regex Denial of Service) is minimized by using AST-based parsers.
• Risk: Mermaid rendering XSS. Since we only parse and check syntax/A11y (we do not render to HTML/SVG in a browser context for the user), XSS risks via Mermaid diagram content are low for the tool itself.

We use pnpm and renovate (or similar) to keep dependencies up to date.

• Critical Dependencies: mermaid (parsing), commander (CLI).

MermaidGuard does not require or handle any secrets, API keys, or credentials. It is a local static analysis tool.

If you discover a security vulnerability, please do not report it publicly. Open a GitHub Security Advisory or contact the maintainers directly.