anymd

Least-privilege permissions

• Run on a dedicated user account with minimal system access—never use administrator or root privileges, even if convenient.
• Restrict file access by storing sensitive documents in a separate folder and only place files there when ready for conversion; don't give anymd access to your entire computer.
• Limit who can use it if shared on a team machine; use OS-level access controls (file permissions, user groups) to prevent unauthorized conversions.

Network isolation

• Keep the machine offline or firewalled when processing highly sensitive documents; anymd doesn't need internet, so physically or logically isolate it from your network if handling confidential data.
• Disable auto-updates temporarily if you're working in an isolated environment; test updates on a connected machine first before applying to the hardened setup.
• Don't expose the CLI over SSH or shared services without authentication; if multiple users access it remotely, add strong access controls or use a VPN.

Monitoring

• Log file conversions (what documents went in, when, and who ran them) using your OS audit tools; review regularly for unexpected activity.
• Spot-check converted Markdown output for retained passwords, email addresses, or internal IDs before sharing results with AI agents or colleagues.
• Track dependency updates by subscribing to Rust security advisories for libraries anymd uses (PDF, Office, media parsers); update promptly when patches drop.

Red flags to watch for

• Unexpected file conversions or large batch processing you didn't initiate; could signal malicious use or a compromised account.
• Markdown containing sensitive data you didn't expect (social security numbers, API keys, personal health info from scanned documents); review OCR and metadata extraction carefully.
• Slow performance or crashes when processing certain files—may indicate malformed files designed to exploit parsing vulnerabilities; quarantine and inspect those files.