Source: https://gometry.monicz.dev/about/security/

# Security & untrusted input

Security decisions depend on the data format chosen at ingress and the validation
run before trusting parsed geometry.

## Accepted untrusted formats

Use these formats for untrusted data contents:

- WKB/EWKB via [`gm.from_wkb`](https://gometry.monicz.dev/api/toplevel/io-interop/#gometry.from_wkb "from_wkb");
- WKT/EWKT via [`gm.from_wkt`](https://gometry.monicz.dev/api/toplevel/io-interop/#gometry.from_wkt "from_wkt");
- GeoJSON via [`gm.from_geojson`](https://gometry.monicz.dev/api/toplevel/io-interop/#gometry.from_geojson "from_geojson"), including feature metadata with
  `features=True`;
- Arrow/GeoArrow/GeoParquet after accepting the provider as a trusted ABI
  participant; the buffers and geometry values are still treated as untrusted
  contents.

The readers fail fast with structured [`ParseError`](https://gometry.monicz.dev/api/errors/#gometry.ParseError "ParseError"), [`CRSError`](https://gometry.monicz.dev/api/errors/#gometry.CRSError "CRSError"),
[`InvalidGeometryError`](https://gometry.monicz.dev/api/errors/#gometry.InvalidGeometryError "InvalidGeometryError"), or [`GeometryError`](https://gometry.monicz.dev/api/errors/#gometry.GeometryError "GeometryError"). Parse untrusted bytes with these
readers, catch the structured exception, then validate or repair only the rows
your workflow accepts:

```python
import gometry as gm

payloads = [
    b"\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0?\x00\x00\x00\x00\x00\x00\x00@",
    b"not wkb",
]

for payload in payloads:
    try:
        geom = gm.from_wkb(payload, crs=4326)
    except gm.ParseError as err:
        print("rejected", err.format)
    else:
        print("accepted", geom.to_wkt())
```

```text
accepted POINT (1 2)
rejected wkb
```

Validate topology with [`geom.validate()`](https://gometry.monicz.dev/api/geometry/geometry/#gometry.Geometry.validate "validate") / [`arr.is_valid`](https://gometry.monicz.dev/api/geometry/geometryarray/#gometry.GeometryArray.is_valid "is_valid property"), and call [`repair()`](https://gometry.monicz.dev/api/geometry/geometry/#gometry.Geometry.repair "repair")
where the workflow accepts repaired shapes.

## Ingress threat model

gometry is an ordinary native extension (like pyarrow, numpy, or polars), not a
sandbox. Its ingress boundaries validate the structures they consume: for
example, Arrow offsets and validity, buffer spans, and supported encoding
shapes are checked before decoding. These checks reject malformed structure;
they do not impose a general payload-size or CPU limit. Arrow providers must
also obey the exported structures, readable spans, capsule names, and release
callbacks; see [Arrow C capsule trust model](https://gometry.monicz.dev/ecosystem/arrow/#arrow-c-capsule-trust-model).

## Collection and allocation

Construction consumes the supplied iterable and may reserve memory from its
reported length. There is no universal element limit; an unbounded iterable can
keep consuming memory and CPU.

Python-provider exceptions propagate. Native allocation failure can abort the
process rather than raise a catchable `MemoryError`. Limit untrusted payload
sizes and batch lengths before passing them to the extension.

## Generated-output and work limits

Coverage factories and H3 traversal methods default to `max_cells=1_000_000`;
passing `max_cells=None` removes that output-count limit. This limit does not
set a CPU deadline for classification or traversal. WKT, WKB, and GeoJSON
parsers reject excessive recursive nesting, but impose no general byte or
feature-count ceiling. [`CellArray.uncompact`](https://gometry.monicz.dev/api/grids/#gometry.CellArray.uncompact "uncompact")
has no result-count limit.

Other limits belong to specific operations. When an operation documents a
generated-output cap, [`ResourceLimitError.code`](https://gometry.monicz.dev/api/errors/#gometry.ResourceLimitError.code "code instance-attribute") is
`'output_limit'` for that refusal. A bounded exact search may return
`code == 'work_limit'` when it stops before certification; that does not prove
no acceptable result exists.
An `OverflowError` with `code == 'output_unrepresentable'` means the operation
could not represent its result while preserving the required topology. None of
these operation-specific errors is a general CPU deadline or a global resource
guarantee.

Syntactically valid geometry can still exhaust CPU or memory through enormous
payloads, vertex counts, feature collections, or expensive topology. Run hostile
or multi-tenant workloads in a process with OS memory/CPU limits and a timeout.
Treat [`repair`](https://gometry.monicz.dev/api/geometry/geometry/#gometry.Geometry.repair "repair"), overlay, validation, and exact spatial refinement as potentially
expensive work after a successful parse.
Python thread timeouts are not hard isolation.

## Never unpickle untrusted data

[`pickle`](https://docs.python.org/3/library/pickle.html) is for trusted Python object persistence only. It can execute Python code
while loading. For untrusted or cross-service data, use WKB, WKT, GeoJSON,
GeoArrow, or GeoParquet.

## Reporting vulnerabilities

A suspected vulnerability goes to GitHub's
[private vulnerability reporting](https://github.com/Zaczero/pkgs/security/advisories/new)
instead of the public issue tracker.

If private reporting is unavailable, contact the maintainers listed in package
metadata. Security fixes ship in a normal release;
[Compatibility](https://gometry.monicz.dev/about/compatibility/) states the supported runtimes.

## See also

- [Errors & exceptions](https://gometry.monicz.dev/guide/errors/) — [`ParseError`](https://gometry.monicz.dev/api/errors/#gometry.ParseError "ParseError"), [`InvalidGeometryError`](https://gometry.monicz.dev/api/errors/#gometry.InvalidGeometryError "InvalidGeometryError"), structured attrs.
- [Validation & repair](https://gometry.monicz.dev/guide/validation/) — [`validate`](https://gometry.monicz.dev/api/geometry/geometry/#gometry.Geometry.validate "validate") / [`repair`](https://gometry.monicz.dev/api/geometry/geometry/#gometry.Geometry.repair "repair") at the boundary.