PDFFillr v1.0.1 — July 17, 2026
Critical security patch fixing an authentication bypass and a path traversal vulnerability in the document upload service. Update to pdf-autofillr-doc-upload v0.1.6 immediately.
SDKs & API
@pdffillr/sdk
TypeScript SDK
TypeScript SDK with strict types, session management, and document flow helpers. Published to npm.
Explore Docs →@pdffillr/ai
AI SDK
AI SDK powered by Claude. Confidence scoring, conversational investor onboarding, multi-jurisdiction support: US, UK, Cayman, Luxembourg.
Explore Docs →OpenAPI 3.1
OpenAPI Specification
Full API specification with interactive Swagger UI. Live at pdffillr.ai/documentation/reference/sdk-ref-sessions
Explore Docs →Critical security patch for the document upload service. Fixes an authentication bypass and a path traversal vulnerability in the document_path parameter, both reported via coordinated disclosure. Upgrade to pdf-autofillr-doc-upload v0.1.6 immediately.
Security Fixes
Authentication bypass — doc-upload service
Fixed fail-open behaviour in _check_api_key() when AUTH_TOKEN env var was unset. Service now returns HTTP 401 instead of processing unauthenticated requests. (CVE pending — pdf-autofillr-doc-upload ≤ v0.1.5)
Path traversal — document_path parameter
Fixed missing directory confinement on the document_path field. Requests with paths like ../../etc/passwd are now rejected with HTTP 400. Affected all storage backends on v0.1.5 and earlier.
Symlink escape — local storage confinement
Switched path confinement from os.path.normpath() to Path.resolve() to follow symlinks before checking allow-list, closing a symlink-escape vector inside the data directory.
SDK & Package Updates
pdf-autofillr-doc-upload v0.1.6
Patched release available on PyPI. Upgrade immediately from v0.1.5 or earlier.
pdf-autofillr-python-sdk updated
Backend SDK updated to depend on doc-upload v0.1.6. No API surface changes.
Complete production release with comprehensive OpenAPI support, full-featured TypeScript and AI SDKs, and enterprise-grade PE document connectors for subscription documents, LP agreements, and regulatory filings.
TypeScript SDK (@pdffillr/sdk)
Multi-step investor onboarding
Session management for KYC → Subscription → LP sign-off workflows
Typed document helpers
Full TypeScript support for LP Agreement, Subscription, AML/CRS forms
Real-time SDK events
Event emitter for field completion, signature requests, and compliance flags
Application flow helpers
Built-in methods: startSubscription(), fillLPAgreement(), submitAML()
Feedback loop API
LP corrections and re-submission without re-uploading entire document
AI SDK (@pdffillr/ai)
Claude-powered field fill
AI-assisted document completion with reasoning engine and field validation
Conversational onboarding
Guided dialogue for KYC, FATCA, and subscription data collection
Auto-population from context
LP Agreement fields auto-populated from investor profile and session history
Confidence scoring
Per-field confidence scores — flags <80% for human review
Multi-jurisdiction support
US, UK, Cayman, Luxembourg fund structures with regulatory mapping
OpenAPI Specification
Full OpenAPI 3.1 spec
Published at /documentation/reference/sdk-ref-sessions with machine-readable schema for all PE investor document fields
Functional connectors
LP Agreement, Subscription Document, AML/CRS Declaration workflows
Swagger UI
Auto-generated reference with try-it-now support at /docs/reference
Key endpoints
/v1/sessions, /v1/documents, /v1/investor/*, /v1/investor/kyc
PE Document Connectors
Subscription Document
ILPA and custom fund manager templates — read/write
LP Agreement
Clause-aware extraction and version diffing — read/write
AML/CRS Declaration
FATF and CRS reporting standards for 50+ jurisdictions — read/write
Security & Compliance
AES-256 encryption at rest
All investor documents encrypted with industry-standard AES-256
TLS 1.3 in transit
All data encrypted in transit with TLS 1.3
Auto-purge policy
PE documents auto-purged after 24hrs by default — configurable via API
SOC 2 Type I audit
Completed — Type II audit in progress
Beta release featuring AI-powered chatbot for investor onboarding, expanded multi-page document support, and initial OpenAPI specification for beta partners.
New Features
AI chatbot beta
KYC and subscription data collection through guided conversation
Multi-page LP Agreement
Support for documents up to 120 pages
Draft OpenAPI spec
Beta partners received spec for feedback and testing
Dark mode UI
Full dark mode support across docs and portal
Improvements
AI field-fill accuracy +40%
Improved accuracy for AML/CRS declaration forms
Onboarding flow reduced
Investor flow condensed from 6 steps to 3 steps
Bug Fixes
Signature field misalignment
Fixed alignment issues on scanned LP Agreement PDFs
Session timeout reset
Session timeout now properly resets during active multi-document flows
Manual field entry
Implemented live preview and PDF export
Initial alpha release with core PDF upload engine, intelligent field detection, and support for standard PE subscription document templates.
Initial Launch
Core PDF upload engine
Intelligent field detection and AcroForm analysis
PE subscription templates
Initial support for standard ILPA format documents
GitHub repository
Opened to internal contributors
Manual field entry
Live preview and PDF export capabilities
Repository
pdfautofillr on GitHubDocumentation
Getting Started →