Author: tallison
Date: Sat Aug 22 01:57:54 2026
New Revision: 1937318

Log:
4.0.0 docs: 4.0.1-SNAPSHOT remaining

Added:
   tika/site/publish/docs/4.0.1-SNAPSHOT/faq.html
   tika/site/publish/docs/4.0.1-SNAPSHOT/index.html
   tika/site/publish/docs/4.0.1-SNAPSHOT/roadmap.html
   tika/site/publish/docs/4.0.1-SNAPSHOT/security.html

Added: tika/site/publish/docs/4.0.1-SNAPSHOT/faq.html
==============================================================================
--- /dev/null   00:00:00 1970   (empty, because file is newly added)
+++ tika/site/publish/docs/4.0.1-SNAPSHOT/faq.html      Sat Aug 22 01:57:54 
2026        (r1937318)
@@ -0,0 +1,481 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <title>FAQ :: Apache Tika Documentation</title>
+    <link rel="canonical" 
href="https://tika.apache.org/docs/tika/4.0.x/faq.html";>
+    <meta name="generator" content="Antora 3.1.15">
+    <link rel="stylesheet" href="../../_/css/site.css">
+  </head>
+  <body class="article">
+<header class="header">
+  <nav class="navbar" aria-label="Main">
+    <div class="navbar-brand">
+      <a class="navbar-item" href="../..">
+        <img src="../../_/img/ASF_Tika-colour.svg" alt="Apache Tika" 
style="height: 2rem; margin-right: 0.5rem; background: white; padding: 2px 4px; 
border-radius: 3px;">
+        Apache Tika Documentation
+      </a>
+      <div class="navbar-item search hide-for-print" role="search">
+        <div id="search-field" class="field">
+          <input id="search-input" type="search" aria-label="Search the docs" 
placeholder="Search the docs">
+        </div>
+      </div>
+      <button class="navbar-burger" aria-controls="topbar-nav" 
aria-expanded="false" aria-label="Toggle main menu" data-target="topbar-nav">
+        <span></span>
+        <span></span>
+        <span></span>
+      </button>
+    </div>
+    <div id="topbar-nav" class="navbar-menu">
+      <div class="navbar-end">
+        <a class="navbar-item" href="https://tika.apache.org";>Apache Tika</a>
+        <a class="navbar-item" href="https://github.com/apache/tika";>GitHub</a>
+      </div>
+    </div>
+  </nav>
+</header>
+<div class="body">
+<div class="nav-container" data-component="tika" data-version="4.0.1-SNAPSHOT">
+  <aside class="nav">
+    <div class="panels">
+<div class="nav-panel-menu is-active" data-panel="menu">
+  <nav class="nav-menu">
+    <button class="nav-menu-toggle" aria-label="Toggle expand/collapse all" 
style="display: none"></button>
+    <h3 class="title"><a href="index.html">Apache Tika</a></h3>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="0">
+<ul class="nav-list">
+  <li class="nav-item" data-depth="1">
+    <a class="nav-link" href="index.html">Home</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="using-tika/index.html">Using Tika</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="using-tika/java-api/index.html">Java API</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="using-tika/java-api/getting-started.html">Getting Started with the Java 
API</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="using-tika/cli/index.html">Command Line</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="using-tika/server/index.html">Tika Server</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="using-tika/server/tls.html">TLS/SSL 
Configuration</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="using-tika/grpc/index.html">gRPC</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="using-tika/docker.html">Running Tika in 
Docker</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="pipes/index.html">Pipes</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/getting-started.html">Getting Started</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/configuration.html">Pipeline 
Configuration</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/fetchers.html">Fetchers</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/emitters.html">Emitters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/iterators.html">Iterators</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/reporters.html">Reporters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/parse-modes.html">Parse Modes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/unpack-config.html">Extracting Embedded 
Bytes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/timeouts.html">Timeouts</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/cpu-sizing.html">Forked-JVM CPU and Heap 
Sizing</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/shared-server-mode.html">Shared Server 
Mode</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/performance.html">Performance and 
Isolation Trade-offs</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/troubleshooting.html">Troubleshooting</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="pipes/plugins/index.html">Plugins</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/writing-a-plugin.html">Writing a 
Pipes Plugin</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/filesystem.html">File System</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/s3.html">Amazon S3</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/gcs.html">Google Cloud Storage</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/azblob.html">Azure Blob Storage</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/opensearch.html">OpenSearch</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="pipes/plugins/elasticsearch.html">Elasticsearch</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/solr.html">Apache Solr</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/jdbc.html">JDBC</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/kafka.html">Apache Kafka</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/http.html">HTTP</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/google-drive.html">Google Drive</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/microsoft-graph.html">Microsoft 
Graph</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/atlassian-jwt.html">Atlassian 
JWT</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/csv.html">CSV</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/json.html">JSON</a>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="configuration/index.html">Configuration</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/parsers/pdf-parser.html">PDF 
Parser</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="configuration/parsers/tesseract-ocr-parser.html">Tesseract OCR</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/parsers/vlm-parsers.html">VLM 
Parsers (Claude, Gemini, OpenAI)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="configuration/parsers/external-parser.html">External Parser (ffmpeg, 
exiftool, etc.)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/parsers/tess4j-parser.html">Tess4J 
OCR (In-Process, advanced)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/metadata-filters.html">Metadata 
Filters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/detectors.html">Detectors</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/digesters.html">Digesters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/encoding-detectors.html">Encoding 
Detectors</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="migration-to-4x/index.html">Migration to 4.x</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="migration-to-4x/migrating-to-4x.html">Migration 
Guide</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/migrating-tika-server-4x.html">Tika Server Migration</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/serialization-4x.html">Serialization Changes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/metadata-changes-4x.html">Metadata Changes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="migration-to-4x/design-notes-4x.html">Design 
Notes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="migration-to-4x/chunk-strategies.html">Chunk 
Strategies</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/inference-handler-requirements.html">Inference Handler 
Requirements</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="advanced/index.html">Advanced</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/robustness.html">Robustness</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/setting-limits.html">Setting Limits</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/spooling.html">TikaInputStream and 
Spooling</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/language-detection.html">Language 
Detection</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/language-detection-build.html">Building 
the Language Detector</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="advanced/charsoup-supported-languages.html">CharSoup Supported 
Languages</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/junk-detection.html">Text Quality 
Scoring (Junk Detection)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/junk-detection-build.html">Building the 
Junk Detector</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/charset-detection-design.html">Charset 
Detection Pipeline</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/zip-detection.html">ZIP Detection and 
Salvaging</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/embedded-documents.html">Embedded 
Document Metadata</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/local-vlm-server.html">Running a Local 
VLM Server</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <span class="nav-text">Integration Testing</span>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/tika-app.html">Testing with Tika App</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/tika-server.html">Testing with Tika 
Server</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/run-uat-script.html">Tika-Server REST UAT 
Script</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/tika-eval-regression.html">Regression 
Evaluation with tika-eval</a>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <a class="nav-link" href="security.html">Security</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="developers/index.html">Developers</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="developers/serialization.html">Serialization and 
Configuration</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="developers/metadata-keys.html">Adding a Metadata 
Key</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item is-current-page" data-depth="1">
+    <a class="nav-link" href="faq.html">FAQ</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <a class="nav-link" href="roadmap.html">Roadmap</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="maintainers/index.html">Maintainers</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="maintainers/site.html">Publishing the Site</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="maintainers/release-guides/index.html">Release 
Guides</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="maintainers/release-guides/tika.html">Releasing 
Apache Tika</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="maintainers/release-guides/release-artifacts.html">Release Artifacts: 
What Goes Where</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="maintainers/release-guides/docker.html">Releasing Tika Docker Images</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="maintainers/release-guides/helm.html">Releasing 
Tika Helm Charts</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="maintainers/release-guides/grpc.html">Releasing 
Tika gRPC</a>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+</ul>
+  </nav>
+</div>
+<div class="nav-panel-explore" data-panel="explore">
+  <div class="context">
+    <span class="title">Apache Tika</span>
+    <span class="version">4.0.1-SNAPSHOT</span>
+  </div>
+  <ul class="components">
+    <li class="component is-current">
+      <div class="title"><a href="../4.0.x/index.html">Apache Tika</a></div>
+      <ul class="versions">
+        <li class="version is-current">
+          <a href="index.html">4.0.1-SNAPSHOT</a>
+        </li>
+        <li class="version is-latest">
+          <a href="../4.0.x/index.html">4.0.x</a>
+        </li>
+      </ul>
+    </li>
+  </ul>
+</div>
+    </div>
+  </aside>
+</div>
+<main class="article">
+<div class="toolbar" role="navigation" aria-label="Page tools">
+<button class="nav-toggle" aria-label="Toggle navigation"></button>
+</div>
+  <div class="content">
+<aside class="toc sidebar" data-title="Contents" data-levels="2">
+  <div class="toc-menu"></div>
+</aside>
+<article class="doc">
+<h1 class="page">FAQ</h1>
+<div id="toc" class="toc">
+<div id="toctitle">Table of Contents</div>
+<ul class="sectlevel1">
+<li><a 
href="#_java_jar_tika_app_jar_fails_with_noclassdeffounderror"><code>java -jar 
tika-app.jar</code> fails with <code>NoClassDefFoundError</code></a></li>
+<li><a href="#_why_is_my_extracted_content_markdown_instead_of_xhtml">Why is 
my extracted content Markdown instead of XHTML?</a></li>
+<li><a href="#_my_tika_config_xml_no_longer_loads">My 
<code>tika-config.xml</code> no longer loads</a></li>
+<li><a href="#_where_did_resourcename_and_the_x_tika_keys_go">Where did 
<code>resourceName</code> and the <code>X-TIKA:*</code> keys go?</a></li>
+<li><a 
href="#_tika_server_returns_429_under_load_that_used_to_succeed">tika-server 
returns <code>429</code> under load that used to succeed</a></li>
+</ul>
+</div>
+<div id="preamble">
+<div class="sectionbody">
+<div class="paragraph">
+<p>The questions below are the ones that come up most often when moving to 
4.x. For pipes and
+tika-server runtime problems, see <a href="pipes/troubleshooting.html" 
class="xref page">Pipes Troubleshooting</a>.
+For anything not answered here, ask on <a 
href="mailto:[email protected]";>[email protected]</a>.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_java_jar_tika_app_jar_fails_with_noclassdeffounderror"><a 
class="anchor" 
href="#_java_jar_tika_app_jar_fails_with_noclassdeffounderror"></a><code>java 
-jar tika-app.jar</code> fails with <code>NoClassDefFoundError</code></h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The <code>tika-app</code> and <code>tika-server-standard</code> jars are 
thin launchers, not fat jars. Download the
+matching <code>.zip</code>, unzip it into a directory (it has no top-level 
directory of its own), and run the
+jar from inside that directory so that <code>lib/</code> and 
<code>plugins/</code> sit alongside it. See
+<a href="migration-to-4x/migrating-to-4x.html#thin-launcher-zip" class="xref 
page">the migration guide</a>.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_why_is_my_extracted_content_markdown_instead_of_xhtml"><a 
class="anchor" 
href="#_why_is_my_extracted_content_markdown_instead_of_xhtml"></a>Why is my 
extracted content Markdown instead of XHTML?</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Markdown is the default content handler in 4.x, in <code>tika-app</code>, 
<code>tika-server</code>, and the pipes
+CLI alike. Ask for another format 
explicitly&#8201;&#8212;&#8201;<code>tika-app -x</code>, 
<code>/tika/xml</code>, <code>--handler x</code>&#8201;&#8212;&#8201;as 
described in
+<a href="migration-to-4x/migrating-to-4x.html#default-handler-markdown" 
class="xref page">the migration guide</a>.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_my_tika_config_xml_no_longer_loads"><a class="anchor" 
href="#_my_tika_config_xml_no_longer_loads"></a>My <code>tika-config.xml</code> 
no longer loads</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>4.x configuration is JSON. Convert an existing XML config with
+<code>java -jar tika-app.jar --convert-config-xml-to-json=tika-config.xml &gt; 
tika-config.json</code>,
+then review the result&#8201;&#8212;&#8201;only the <code>parsers</code> 
section is converted. See
+<a href="configuration/index.html" class="xref page">Configuration</a>.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_where_did_resourcename_and_the_x_tika_keys_go"><a class="anchor" 
href="#_where_did_resourcename_and_the_x_tika_keys_go"></a>Where did 
<code>resourceName</code> and the <code>X-TIKA:*</code> keys go?</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Every Tika-asserted key now lives under <code>tk:</code> in kebab-case 
(<code>tk:resource-name</code>,
+<code>tk:content</code>, &#8230;&#8203;). To keep an unmigrated consumer 
working, enable the
+<code>legacy-key-migration-filter</code>, which rewrites keys at the emit edge 
in either direction. Both
+the full rename table and the filter are documented in
+<a href="migration-to-4x/metadata-changes-4x.html" class="xref page">Metadata 
Changes in 4.x</a>.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_tika_server_returns_429_under_load_that_used_to_succeed"><a 
class="anchor" 
href="#_tika_server_returns_429_under_load_that_used_to_succeed"></a>tika-server
 returns <code>429</code> under load that used to succeed</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p><code>/tika</code>, <code>/rmeta</code>, <code>/meta</code>, and 
<code>/unpack</code> now parse in a fixed pool of <code>numClients</code> forked
+JVMs instead of on the request thread, so a saturated pool pushes back rather 
than queueing.
+The <code>429</code> is deliberate and distinguishable from a crashed 
fork&#8217;s <code>503</code>&#8201;&#8212;&#8201;see
+<a href="migration-to-4x/migrating-tika-server-4x.html#backpressure" 
class="xref page">Backpressure</a>&#8201;&#8212;&#8201;and the
+remedy is to size <code>numClients</code> for your request volume and core 
count
+(<a href="pipes/cpu-sizing.html" class="xref page">Forked-JVM CPU and Heap 
Sizing</a>).</p>
+</div>
+</div>
+</div>
+</article>
+  </div>
+</main>
+</div>
+<footer class="footer">
+  <p>© Apache Software Foundation. All rights reserved.</p>
+</footer>
+<script id="site-script" src="../../_/js/site.js" 
data-ui-root-path="../../_"></script>
+<script async src="../../_/js/vendor/highlight.js"></script>
+<script src="../../_/js/vendor/lunr.js"></script>
+<script src="../../_/js/search-ui.js" id="search-ui-script" 
data-site-root-path="../.." data-snippet-length="150" 
data-stylesheet="../../_/css/search.css"></script>
+<script async src="../../search-index.js"></script>
+  </body>
+</html>

Added: tika/site/publish/docs/4.0.1-SNAPSHOT/index.html
==============================================================================
--- /dev/null   00:00:00 1970   (empty, because file is newly added)
+++ tika/site/publish/docs/4.0.1-SNAPSHOT/index.html    Sat Aug 22 01:57:54 
2026        (r1937318)
@@ -0,0 +1,478 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <title>Apache Tika Documentation :: Apache Tika Documentation</title>
+    <link rel="canonical" 
href="https://tika.apache.org/docs/tika/4.0.x/index.html";>
+    <meta name="generator" content="Antora 3.1.15">
+    <link rel="stylesheet" href="../../_/css/site.css">
+  </head>
+  <body class="article">
+<header class="header">
+  <nav class="navbar" aria-label="Main">
+    <div class="navbar-brand">
+      <a class="navbar-item" href="../..">
+        <img src="../../_/img/ASF_Tika-colour.svg" alt="Apache Tika" 
style="height: 2rem; margin-right: 0.5rem; background: white; padding: 2px 4px; 
border-radius: 3px;">
+        Apache Tika Documentation
+      </a>
+      <div class="navbar-item search hide-for-print" role="search">
+        <div id="search-field" class="field">
+          <input id="search-input" type="search" aria-label="Search the docs" 
placeholder="Search the docs">
+        </div>
+      </div>
+      <button class="navbar-burger" aria-controls="topbar-nav" 
aria-expanded="false" aria-label="Toggle main menu" data-target="topbar-nav">
+        <span></span>
+        <span></span>
+        <span></span>
+      </button>
+    </div>
+    <div id="topbar-nav" class="navbar-menu">
+      <div class="navbar-end">
+        <a class="navbar-item" href="https://tika.apache.org";>Apache Tika</a>
+        <a class="navbar-item" href="https://github.com/apache/tika";>GitHub</a>
+      </div>
+    </div>
+  </nav>
+</header>
+<div class="body">
+<div class="nav-container" data-component="tika" data-version="4.0.1-SNAPSHOT">
+  <aside class="nav">
+    <div class="panels">
+<div class="nav-panel-menu is-active" data-panel="menu">
+  <nav class="nav-menu">
+    <button class="nav-menu-toggle" aria-label="Toggle expand/collapse all" 
style="display: none"></button>
+    <h3 class="title"><a href="index.html">Apache Tika</a></h3>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="0">
+<ul class="nav-list">
+  <li class="nav-item is-current-page" data-depth="1">
+    <a class="nav-link" href="index.html">Home</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="using-tika/index.html">Using Tika</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="using-tika/java-api/index.html">Java API</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="using-tika/java-api/getting-started.html">Getting Started with the Java 
API</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="using-tika/cli/index.html">Command Line</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="using-tika/server/index.html">Tika Server</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="using-tika/server/tls.html">TLS/SSL 
Configuration</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="using-tika/grpc/index.html">gRPC</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="using-tika/docker.html">Running Tika in 
Docker</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="pipes/index.html">Pipes</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/getting-started.html">Getting Started</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/configuration.html">Pipeline 
Configuration</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/fetchers.html">Fetchers</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/emitters.html">Emitters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/iterators.html">Iterators</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/reporters.html">Reporters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/parse-modes.html">Parse Modes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/unpack-config.html">Extracting Embedded 
Bytes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/timeouts.html">Timeouts</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/cpu-sizing.html">Forked-JVM CPU and Heap 
Sizing</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/shared-server-mode.html">Shared Server 
Mode</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/performance.html">Performance and 
Isolation Trade-offs</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/troubleshooting.html">Troubleshooting</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="pipes/plugins/index.html">Plugins</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/writing-a-plugin.html">Writing a 
Pipes Plugin</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/filesystem.html">File System</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/s3.html">Amazon S3</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/gcs.html">Google Cloud Storage</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/azblob.html">Azure Blob Storage</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/opensearch.html">OpenSearch</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="pipes/plugins/elasticsearch.html">Elasticsearch</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/solr.html">Apache Solr</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/jdbc.html">JDBC</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/kafka.html">Apache Kafka</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/http.html">HTTP</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/google-drive.html">Google Drive</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/microsoft-graph.html">Microsoft 
Graph</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/atlassian-jwt.html">Atlassian 
JWT</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/csv.html">CSV</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/json.html">JSON</a>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="configuration/index.html">Configuration</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/parsers/pdf-parser.html">PDF 
Parser</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="configuration/parsers/tesseract-ocr-parser.html">Tesseract OCR</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/parsers/vlm-parsers.html">VLM 
Parsers (Claude, Gemini, OpenAI)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="configuration/parsers/external-parser.html">External Parser (ffmpeg, 
exiftool, etc.)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/parsers/tess4j-parser.html">Tess4J 
OCR (In-Process, advanced)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/metadata-filters.html">Metadata 
Filters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/detectors.html">Detectors</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/digesters.html">Digesters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/encoding-detectors.html">Encoding 
Detectors</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="migration-to-4x/index.html">Migration to 4.x</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="migration-to-4x/migrating-to-4x.html">Migration 
Guide</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/migrating-tika-server-4x.html">Tika Server Migration</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/serialization-4x.html">Serialization Changes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/metadata-changes-4x.html">Metadata Changes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="migration-to-4x/design-notes-4x.html">Design 
Notes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="migration-to-4x/chunk-strategies.html">Chunk 
Strategies</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/inference-handler-requirements.html">Inference Handler 
Requirements</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="advanced/index.html">Advanced</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/robustness.html">Robustness</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/setting-limits.html">Setting Limits</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/spooling.html">TikaInputStream and 
Spooling</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/language-detection.html">Language 
Detection</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/language-detection-build.html">Building 
the Language Detector</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="advanced/charsoup-supported-languages.html">CharSoup Supported 
Languages</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/junk-detection.html">Text Quality 
Scoring (Junk Detection)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/junk-detection-build.html">Building the 
Junk Detector</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/charset-detection-design.html">Charset 
Detection Pipeline</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/zip-detection.html">ZIP Detection and 
Salvaging</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/embedded-documents.html">Embedded 
Document Metadata</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/local-vlm-server.html">Running a Local 
VLM Server</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <span class="nav-text">Integration Testing</span>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/tika-app.html">Testing with Tika App</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/tika-server.html">Testing with Tika 
Server</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/run-uat-script.html">Tika-Server REST UAT 
Script</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/tika-eval-regression.html">Regression 
Evaluation with tika-eval</a>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <a class="nav-link" href="security.html">Security</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="developers/index.html">Developers</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="developers/serialization.html">Serialization and 
Configuration</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="developers/metadata-keys.html">Adding a Metadata 
Key</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <a class="nav-link" href="faq.html">FAQ</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <a class="nav-link" href="roadmap.html">Roadmap</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="maintainers/index.html">Maintainers</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="maintainers/site.html">Publishing the Site</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="maintainers/release-guides/index.html">Release 
Guides</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="maintainers/release-guides/tika.html">Releasing 
Apache Tika</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="maintainers/release-guides/release-artifacts.html">Release Artifacts: 
What Goes Where</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="maintainers/release-guides/docker.html">Releasing Tika Docker Images</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="maintainers/release-guides/helm.html">Releasing 
Tika Helm Charts</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="maintainers/release-guides/grpc.html">Releasing 
Tika gRPC</a>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+</ul>
+  </nav>
+</div>
+<div class="nav-panel-explore" data-panel="explore">
+  <div class="context">
+    <span class="title">Apache Tika</span>
+    <span class="version">4.0.1-SNAPSHOT</span>
+  </div>
+  <ul class="components">
+    <li class="component is-current">
+      <div class="title"><a href="../4.0.x/index.html">Apache Tika</a></div>
+      <ul class="versions">
+        <li class="version is-current">
+          <a href="index.html">4.0.1-SNAPSHOT</a>
+        </li>
+        <li class="version is-latest">
+          <a href="../4.0.x/index.html">4.0.x</a>
+        </li>
+      </ul>
+    </li>
+  </ul>
+</div>
+    </div>
+  </aside>
+</div>
+<main class="article">
+<div class="toolbar" role="navigation" aria-label="Page tools">
+<button class="nav-toggle" aria-label="Toggle navigation"></button>
+</div>
+  <div class="content">
+<aside class="toc sidebar" data-title="Contents" data-levels="2">
+  <div class="toc-menu"></div>
+</aside>
+<article class="doc">
+<h1 class="page">Apache Tika Documentation</h1>
+<div id="toc" class="toc">
+<div id="toctitle">Table of Contents</div>
+<ul class="sectlevel1">
+<li><a href="#_where_to_start">Where to start</a></li>
+</ul>
+</div>
+<div id="preamble">
+<div class="sectionbody">
+<div class="admonitionblock warning">
+<table>
+<tr>
+<td class="icon">
+<i class="fa icon-warning" title="Warning"></i>
+</td>
+<td class="content">
+This reference guide was generated with the assistance of AI and requires
+human review before it can be fully trusted. This documentation serves as an 
example
+and a starting point, but more work remains. Contributions and corrections are 
welcome.
+</td>
+</tr>
+</table>
+</div>
+<div class="paragraph">
+<p>The Apache Tika toolkit detects and extracts metadata and text from over a 
thousand
+different file types (such as PPT, XLS, and PDF). All of these file types can 
be parsed
+through a single interface, making Tika useful for search engine indexing, 
content
+analysis, translation, and much more. Tika identifies a file&#8217;s type from 
its bytes, so a
+missing or misleading extension does not change the result.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_where_to_start"><a class="anchor" href="#_where_to_start"></a>Where 
to start</h2>
+<div class="sectionbody">
+<div class="ulist">
+<ul>
+<li>
+<p><a href="using-tika/index.html" class="xref page">Using 
Tika</a>&#8201;&#8212;&#8201;choose an integration method: Java API,
+command line, REST server, or gRPC.</p>
+</li>
+<li>
+<p><a href="pipes/index.html" class="xref 
page">Pipes</a>&#8201;&#8212;&#8201;process-isolated, fault-tolerant extraction 
at scale.</p>
+</li>
+<li>
+<p><a href="configuration/index.html" class="xref 
page">Configuration</a>&#8201;&#8212;&#8201;the JSON config file: parsers,
+detectors, metadata filters.</p>
+</li>
+<li>
+<p><a href="advanced/setting-limits.html" class="xref page">Setting Limits</a> 
and
+<a href="advanced/robustness.html" class="xref 
page">Robustness</a>&#8201;&#8212;&#8201;bounding time, memory and output when
+parsing content you do not control.</p>
+</li>
+<li>
+<p><a href="security.html" class="xref 
page">Security</a>&#8201;&#8212;&#8201;the trust model, and what to lock down 
before exposing
+tika-server or tika-grpc.</p>
+</li>
+<li>
+<p><a href="migration-to-4x/index.html" class="xref page">Migrating to 
4.x</a>&#8201;&#8212;&#8201;what changed since 3.x and what
+you have to update.</p>
+</li>
+<li>
+<p><a href="faq.html" class="xref page">FAQ</a>&#8201;&#8212;&#8201;the 
questions upgraders ask most.</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>Apache Tika is an Apache Software Foundation project, formerly a subproject 
of Apache Lucene.</p>
+</div>
+<div class="paragraph">
+<p><span class="small">Built from commit: <code>81f2eb01d6 
(2026-08-21)</code></span></p>
+</div>
+</div>
+</div>
+</article>
+  </div>
+</main>
+</div>
+<footer class="footer">
+  <p>© Apache Software Foundation. All rights reserved.</p>
+</footer>
+<script id="site-script" src="../../_/js/site.js" 
data-ui-root-path="../../_"></script>
+<script async src="../../_/js/vendor/highlight.js"></script>
+<script src="../../_/js/vendor/lunr.js"></script>
+<script src="../../_/js/search-ui.js" id="search-ui-script" 
data-site-root-path="../.." data-snippet-length="150" 
data-stylesheet="../../_/css/search.css"></script>
+<script async src="../../search-index.js"></script>
+  </body>
+</html>

Added: tika/site/publish/docs/4.0.1-SNAPSHOT/roadmap.html
==============================================================================
--- /dev/null   00:00:00 1970   (empty, because file is newly added)
+++ tika/site/publish/docs/4.0.1-SNAPSHOT/roadmap.html  Sat Aug 22 01:57:54 
2026        (r1937318)
@@ -0,0 +1,496 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <title>Apache Tika Roadmap :: Apache Tika Documentation</title>
+    <link rel="canonical" 
href="https://tika.apache.org/docs/tika/4.0.x/roadmap.html";>
+    <meta name="generator" content="Antora 3.1.15">
+    <link rel="stylesheet" href="../../_/css/site.css">
+  </head>
+  <body class="article">
+<header class="header">
+  <nav class="navbar" aria-label="Main">
+    <div class="navbar-brand">
+      <a class="navbar-item" href="../..">
+        <img src="../../_/img/ASF_Tika-colour.svg" alt="Apache Tika" 
style="height: 2rem; margin-right: 0.5rem; background: white; padding: 2px 4px; 
border-radius: 3px;">
+        Apache Tika Documentation
+      </a>
+      <div class="navbar-item search hide-for-print" role="search">
+        <div id="search-field" class="field">
+          <input id="search-input" type="search" aria-label="Search the docs" 
placeholder="Search the docs">
+        </div>
+      </div>
+      <button class="navbar-burger" aria-controls="topbar-nav" 
aria-expanded="false" aria-label="Toggle main menu" data-target="topbar-nav">
+        <span></span>
+        <span></span>
+        <span></span>
+      </button>
+    </div>
+    <div id="topbar-nav" class="navbar-menu">
+      <div class="navbar-end">
+        <a class="navbar-item" href="https://tika.apache.org";>Apache Tika</a>
+        <a class="navbar-item" href="https://github.com/apache/tika";>GitHub</a>
+      </div>
+    </div>
+  </nav>
+</header>
+<div class="body">
+<div class="nav-container" data-component="tika" data-version="4.0.1-SNAPSHOT">
+  <aside class="nav">
+    <div class="panels">
+<div class="nav-panel-menu is-active" data-panel="menu">
+  <nav class="nav-menu">
+    <button class="nav-menu-toggle" aria-label="Toggle expand/collapse all" 
style="display: none"></button>
+    <h3 class="title"><a href="index.html">Apache Tika</a></h3>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="0">
+<ul class="nav-list">
+  <li class="nav-item" data-depth="1">
+    <a class="nav-link" href="index.html">Home</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="using-tika/index.html">Using Tika</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="using-tika/java-api/index.html">Java API</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="using-tika/java-api/getting-started.html">Getting Started with the Java 
API</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="using-tika/cli/index.html">Command Line</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="using-tika/server/index.html">Tika Server</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="using-tika/server/tls.html">TLS/SSL 
Configuration</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="using-tika/grpc/index.html">gRPC</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="using-tika/docker.html">Running Tika in 
Docker</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="pipes/index.html">Pipes</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/getting-started.html">Getting Started</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/configuration.html">Pipeline 
Configuration</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/fetchers.html">Fetchers</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/emitters.html">Emitters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/iterators.html">Iterators</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/reporters.html">Reporters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/parse-modes.html">Parse Modes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/unpack-config.html">Extracting Embedded 
Bytes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/timeouts.html">Timeouts</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/cpu-sizing.html">Forked-JVM CPU and Heap 
Sizing</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/shared-server-mode.html">Shared Server 
Mode</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/performance.html">Performance and 
Isolation Trade-offs</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/troubleshooting.html">Troubleshooting</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="pipes/plugins/index.html">Plugins</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/writing-a-plugin.html">Writing a 
Pipes Plugin</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/filesystem.html">File System</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/s3.html">Amazon S3</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/gcs.html">Google Cloud Storage</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/azblob.html">Azure Blob Storage</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/opensearch.html">OpenSearch</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="pipes/plugins/elasticsearch.html">Elasticsearch</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/solr.html">Apache Solr</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/jdbc.html">JDBC</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/kafka.html">Apache Kafka</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/http.html">HTTP</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/google-drive.html">Google Drive</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/microsoft-graph.html">Microsoft 
Graph</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/atlassian-jwt.html">Atlassian 
JWT</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/csv.html">CSV</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/json.html">JSON</a>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="configuration/index.html">Configuration</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/parsers/pdf-parser.html">PDF 
Parser</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="configuration/parsers/tesseract-ocr-parser.html">Tesseract OCR</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/parsers/vlm-parsers.html">VLM 
Parsers (Claude, Gemini, OpenAI)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="configuration/parsers/external-parser.html">External Parser (ffmpeg, 
exiftool, etc.)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/parsers/tess4j-parser.html">Tess4J 
OCR (In-Process, advanced)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/metadata-filters.html">Metadata 
Filters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/detectors.html">Detectors</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/digesters.html">Digesters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/encoding-detectors.html">Encoding 
Detectors</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="migration-to-4x/index.html">Migration to 4.x</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="migration-to-4x/migrating-to-4x.html">Migration 
Guide</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/migrating-tika-server-4x.html">Tika Server Migration</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/serialization-4x.html">Serialization Changes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/metadata-changes-4x.html">Metadata Changes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="migration-to-4x/design-notes-4x.html">Design 
Notes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="migration-to-4x/chunk-strategies.html">Chunk 
Strategies</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/inference-handler-requirements.html">Inference Handler 
Requirements</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="advanced/index.html">Advanced</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/robustness.html">Robustness</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/setting-limits.html">Setting Limits</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/spooling.html">TikaInputStream and 
Spooling</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/language-detection.html">Language 
Detection</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/language-detection-build.html">Building 
the Language Detector</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="advanced/charsoup-supported-languages.html">CharSoup Supported 
Languages</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/junk-detection.html">Text Quality 
Scoring (Junk Detection)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/junk-detection-build.html">Building the 
Junk Detector</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/charset-detection-design.html">Charset 
Detection Pipeline</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/zip-detection.html">ZIP Detection and 
Salvaging</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/embedded-documents.html">Embedded 
Document Metadata</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/local-vlm-server.html">Running a Local 
VLM Server</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <span class="nav-text">Integration Testing</span>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/tika-app.html">Testing with Tika App</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/tika-server.html">Testing with Tika 
Server</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/run-uat-script.html">Tika-Server REST UAT 
Script</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/tika-eval-regression.html">Regression 
Evaluation with tika-eval</a>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <a class="nav-link" href="security.html">Security</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="developers/index.html">Developers</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="developers/serialization.html">Serialization and 
Configuration</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="developers/metadata-keys.html">Adding a Metadata 
Key</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <a class="nav-link" href="faq.html">FAQ</a>
+  </li>
+  <li class="nav-item is-current-page" data-depth="1">
+    <a class="nav-link" href="roadmap.html">Roadmap</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="maintainers/index.html">Maintainers</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="maintainers/site.html">Publishing the Site</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="maintainers/release-guides/index.html">Release 
Guides</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="maintainers/release-guides/tika.html">Releasing 
Apache Tika</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="maintainers/release-guides/release-artifacts.html">Release Artifacts: 
What Goes Where</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="maintainers/release-guides/docker.html">Releasing Tika Docker Images</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="maintainers/release-guides/helm.html">Releasing 
Tika Helm Charts</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="maintainers/release-guides/grpc.html">Releasing 
Tika gRPC</a>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+</ul>
+  </nav>
+</div>
+<div class="nav-panel-explore" data-panel="explore">
+  <div class="context">
+    <span class="title">Apache Tika</span>
+    <span class="version">4.0.1-SNAPSHOT</span>
+  </div>
+  <ul class="components">
+    <li class="component is-current">
+      <div class="title"><a href="../4.0.x/index.html">Apache Tika</a></div>
+      <ul class="versions">
+        <li class="version is-current">
+          <a href="index.html">4.0.1-SNAPSHOT</a>
+        </li>
+        <li class="version is-latest">
+          <a href="../4.0.x/index.html">4.0.x</a>
+        </li>
+      </ul>
+    </li>
+  </ul>
+</div>
+    </div>
+  </aside>
+</div>
+<main class="article">
+<div class="toolbar" role="navigation" aria-label="Page tools">
+<button class="nav-toggle" aria-label="Toggle navigation"></button>
+</div>
+  <div class="content">
+<aside class="toc sidebar" data-title="Contents" data-levels="2">
+  <div class="toc-menu"></div>
+</aside>
+<article class="doc">
+<h1 class="page">Apache Tika Roadmap</h1>
+<div id="toc" class="toc">
+<div id="toctitle">Table of Contents</div>
+<ul class="sectlevel1">
+<li><a href="#_version_support">Version Support</a></li>
+</ul>
+</div>
+<div id="preamble">
+<div class="sectionbody">
+<div class="paragraph">
+<p>Which Tika line runs on which Java, and how long each is supported.</p>
+</div>
+<div class="admonitionblock note">
+<table>
+<tr>
+<td class="icon">
+<i class="fa icon-note" title="Note"></i>
+</td>
+<td class="content">
+Only 2.x and 3.x have shipped. Everything from 4.x down is a plan, not a 
commitment, and
+all dates are in Open Source Standard Time which does not always neatly align 
with traditional
+calendars.
+</td>
+</tr>
+</table>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_version_support"><a class="anchor" 
href="#_version_support"></a>Version Support</h2>
+<div class="sectionbody">
+<table class="tableblock frame-all grid-all stretch">
+<colgroup>
+<col style="width: 14.2857%;">
+<col style="width: 14.2857%;">
+<col style="width: 14.2857%;">
+<col style="width: 28.5714%;">
+<col style="width: 28.5715%;">
+</colgroup>
+<thead>
+<tr>
+<th class="tableblock halign-left valign-top">Version</th>
+<th class="tableblock halign-left valign-top">Java</th>
+<th class="tableblock halign-left valign-top">Jakarta/javax</th>
+<th class="tableblock halign-left valign-top">Released</th>
+<th class="tableblock halign-left valign-top">End of support</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">2.x</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">8</p></td>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">javax</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">July 
2021</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">April 2025 
(ended)</p></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">3.x</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">11</p></td>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">jakarta</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">October 
2024</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">March 
2027</p></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">4.x</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">17</p></td>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">jakarta</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">not yet 
released (4.0.0 in progress)</p></td>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">TBD</p></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">5.x</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">21</p></td>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">jakarta</p></td>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">TBD</p></td>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">TBD</p></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">6.x</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">25</p></td>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">jakarta</p></td>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">TBD</p></td>
+<td class="tableblock halign-left valign-top"><p 
class="tableblock">TBD</p></td>
+</tr>
+</tbody>
+</table>
+<div class="paragraph">
+<p>For what changes between 3.x and 4.x, see
+<a href="migration-to-4x/index.html" class="xref page">Migrating to Tika 
4.x</a>.</p>
+</div>
+</div>
+</div>
+</article>
+  </div>
+</main>
+</div>
+<footer class="footer">
+  <p>© Apache Software Foundation. All rights reserved.</p>
+</footer>
+<script id="site-script" src="../../_/js/site.js" 
data-ui-root-path="../../_"></script>
+<script async src="../../_/js/vendor/highlight.js"></script>
+<script src="../../_/js/vendor/lunr.js"></script>
+<script src="../../_/js/search-ui.js" id="search-ui-script" 
data-site-root-path="../.." data-snippet-length="150" 
data-stylesheet="../../_/css/search.css"></script>
+<script async src="../../search-index.js"></script>
+  </body>
+</html>

Added: tika/site/publish/docs/4.0.1-SNAPSHOT/security.html
==============================================================================
--- /dev/null   00:00:00 1970   (empty, because file is newly added)
+++ tika/site/publish/docs/4.0.1-SNAPSHOT/security.html Sat Aug 22 01:57:54 
2026        (r1937318)
@@ -0,0 +1,644 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <title>Security :: Apache Tika Documentation</title>
+    <link rel="canonical" 
href="https://tika.apache.org/docs/tika/4.0.x/security.html";>
+    <meta name="generator" content="Antora 3.1.15">
+    <link rel="stylesheet" href="../../_/css/site.css">
+  </head>
+  <body class="article">
+<header class="header">
+  <nav class="navbar" aria-label="Main">
+    <div class="navbar-brand">
+      <a class="navbar-item" href="../..">
+        <img src="../../_/img/ASF_Tika-colour.svg" alt="Apache Tika" 
style="height: 2rem; margin-right: 0.5rem; background: white; padding: 2px 4px; 
border-radius: 3px;">
+        Apache Tika Documentation
+      </a>
+      <div class="navbar-item search hide-for-print" role="search">
+        <div id="search-field" class="field">
+          <input id="search-input" type="search" aria-label="Search the docs" 
placeholder="Search the docs">
+        </div>
+      </div>
+      <button class="navbar-burger" aria-controls="topbar-nav" 
aria-expanded="false" aria-label="Toggle main menu" data-target="topbar-nav">
+        <span></span>
+        <span></span>
+        <span></span>
+      </button>
+    </div>
+    <div id="topbar-nav" class="navbar-menu">
+      <div class="navbar-end">
+        <a class="navbar-item" href="https://tika.apache.org";>Apache Tika</a>
+        <a class="navbar-item" href="https://github.com/apache/tika";>GitHub</a>
+      </div>
+    </div>
+  </nav>
+</header>
+<div class="body">
+<div class="nav-container" data-component="tika" data-version="4.0.1-SNAPSHOT">
+  <aside class="nav">
+    <div class="panels">
+<div class="nav-panel-menu is-active" data-panel="menu">
+  <nav class="nav-menu">
+    <button class="nav-menu-toggle" aria-label="Toggle expand/collapse all" 
style="display: none"></button>
+    <h3 class="title"><a href="index.html">Apache Tika</a></h3>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="0">
+<ul class="nav-list">
+  <li class="nav-item" data-depth="1">
+    <a class="nav-link" href="index.html">Home</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="using-tika/index.html">Using Tika</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="using-tika/java-api/index.html">Java API</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="using-tika/java-api/getting-started.html">Getting Started with the Java 
API</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="using-tika/cli/index.html">Command Line</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="using-tika/server/index.html">Tika Server</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="using-tika/server/tls.html">TLS/SSL 
Configuration</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="using-tika/grpc/index.html">gRPC</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="using-tika/docker.html">Running Tika in 
Docker</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="pipes/index.html">Pipes</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/getting-started.html">Getting Started</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/configuration.html">Pipeline 
Configuration</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/fetchers.html">Fetchers</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/emitters.html">Emitters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/iterators.html">Iterators</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/reporters.html">Reporters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/parse-modes.html">Parse Modes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/unpack-config.html">Extracting Embedded 
Bytes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/timeouts.html">Timeouts</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/cpu-sizing.html">Forked-JVM CPU and Heap 
Sizing</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/shared-server-mode.html">Shared Server 
Mode</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/performance.html">Performance and 
Isolation Trade-offs</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="pipes/troubleshooting.html">Troubleshooting</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="pipes/plugins/index.html">Plugins</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/writing-a-plugin.html">Writing a 
Pipes Plugin</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/filesystem.html">File System</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/s3.html">Amazon S3</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/gcs.html">Google Cloud Storage</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/azblob.html">Azure Blob Storage</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/opensearch.html">OpenSearch</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="pipes/plugins/elasticsearch.html">Elasticsearch</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/solr.html">Apache Solr</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/jdbc.html">JDBC</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/kafka.html">Apache Kafka</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/http.html">HTTP</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/google-drive.html">Google Drive</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/microsoft-graph.html">Microsoft 
Graph</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/atlassian-jwt.html">Atlassian 
JWT</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/csv.html">CSV</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="pipes/plugins/json.html">JSON</a>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="configuration/index.html">Configuration</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/parsers/pdf-parser.html">PDF 
Parser</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="configuration/parsers/tesseract-ocr-parser.html">Tesseract OCR</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/parsers/vlm-parsers.html">VLM 
Parsers (Claude, Gemini, OpenAI)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="configuration/parsers/external-parser.html">External Parser (ffmpeg, 
exiftool, etc.)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/parsers/tess4j-parser.html">Tess4J 
OCR (In-Process, advanced)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/metadata-filters.html">Metadata 
Filters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/detectors.html">Detectors</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/digesters.html">Digesters</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="configuration/encoding-detectors.html">Encoding 
Detectors</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="migration-to-4x/index.html">Migration to 4.x</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="migration-to-4x/migrating-to-4x.html">Migration 
Guide</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/migrating-tika-server-4x.html">Tika Server Migration</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/serialization-4x.html">Serialization Changes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/metadata-changes-4x.html">Metadata Changes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="migration-to-4x/design-notes-4x.html">Design 
Notes</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="migration-to-4x/chunk-strategies.html">Chunk 
Strategies</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="migration-to-4x/inference-handler-requirements.html">Inference Handler 
Requirements</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="advanced/index.html">Advanced</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/robustness.html">Robustness</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/setting-limits.html">Setting Limits</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/spooling.html">TikaInputStream and 
Spooling</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/language-detection.html">Language 
Detection</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/language-detection-build.html">Building 
the Language Detector</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" 
href="advanced/charsoup-supported-languages.html">CharSoup Supported 
Languages</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/junk-detection.html">Text Quality 
Scoring (Junk Detection)</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/junk-detection-build.html">Building the 
Junk Detector</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/charset-detection-design.html">Charset 
Detection Pipeline</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/zip-detection.html">ZIP Detection and 
Salvaging</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/embedded-documents.html">Embedded 
Document Metadata</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="advanced/local-vlm-server.html">Running a Local 
VLM Server</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <span class="nav-text">Integration Testing</span>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/tika-app.html">Testing with Tika App</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/tika-server.html">Testing with Tika 
Server</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/run-uat-script.html">Tika-Server REST UAT 
Script</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="advanced/integration-testing/tika-eval-regression.html">Regression 
Evaluation with tika-eval</a>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item is-current-page" data-depth="1">
+    <a class="nav-link" href="security.html">Security</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="developers/index.html">Developers</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="developers/serialization.html">Serialization and 
Configuration</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="developers/metadata-keys.html">Adding a Metadata 
Key</a>
+  </li>
+</ul>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <a class="nav-link" href="faq.html">FAQ</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <a class="nav-link" href="roadmap.html">Roadmap</a>
+  </li>
+  <li class="nav-item" data-depth="1">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="maintainers/index.html">Maintainers</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="2">
+    <a class="nav-link" href="maintainers/site.html">Publishing the Site</a>
+  </li>
+  <li class="nav-item" data-depth="2">
+    <button class="nav-item-toggle"></button>
+    <a class="nav-link" href="maintainers/release-guides/index.html">Release 
Guides</a>
+<ul class="nav-list">
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="maintainers/release-guides/tika.html">Releasing 
Apache Tika</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="maintainers/release-guides/release-artifacts.html">Release Artifacts: 
What Goes Where</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" 
href="maintainers/release-guides/docker.html">Releasing Tika Docker Images</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="maintainers/release-guides/helm.html">Releasing 
Tika Helm Charts</a>
+  </li>
+  <li class="nav-item" data-depth="3">
+    <a class="nav-link" href="maintainers/release-guides/grpc.html">Releasing 
Tika gRPC</a>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+</ul>
+  </li>
+</ul>
+  </nav>
+</div>
+<div class="nav-panel-explore" data-panel="explore">
+  <div class="context">
+    <span class="title">Apache Tika</span>
+    <span class="version">4.0.1-SNAPSHOT</span>
+  </div>
+  <ul class="components">
+    <li class="component is-current">
+      <div class="title"><a href="../4.0.x/index.html">Apache Tika</a></div>
+      <ul class="versions">
+        <li class="version is-current">
+          <a href="index.html">4.0.1-SNAPSHOT</a>
+        </li>
+        <li class="version is-latest">
+          <a href="../4.0.x/index.html">4.0.x</a>
+        </li>
+      </ul>
+    </li>
+  </ul>
+</div>
+    </div>
+  </aside>
+</div>
+<main class="article">
+<div class="toolbar" role="navigation" aria-label="Page tools">
+<button class="nav-toggle" aria-label="Toggle navigation"></button>
+</div>
+  <div class="content">
+<aside class="toc sidebar" data-title="Contents" data-levels="2">
+  <div class="toc-menu"></div>
+</aside>
+<article class="doc">
+<h1 class="page">Security</h1>
+<div id="toc" class="toc">
+<div id="toctitle">Table of Contents</div>
+<ul class="sectlevel1">
+<li><a href="#_security_model">Security Model</a>
+<ul class="sectlevel2">
+<li><a href="#in-process-dos">In-Process Parsing and Denial of Service</a></li>
+<li><a href="#_tika_server_and_grpc_trust_model">Tika Server and gRPC Trust 
Model</a></li>
+</ul>
+</li>
+<li><a href="#_known_vulnerabilities">Known Vulnerabilities</a></li>
+<li><a href="#_external_command_security">External Command Security</a>
+<ul class="sectlevel2">
+<li><a href="#_security_best_practices">Security Best Practices</a></li>
+<li><a href="#_externalparser_specific_risks">ExternalParser-Specific 
Risks</a></li>
+</ul>
+</li>
+<li><a href="#_credential_handling">Credential Handling</a></li>
+</ul>
+</div>
+<div id="preamble">
+<div class="sectionbody">
+<div class="paragraph">
+<p>This page covers security considerations when using Apache Tika.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_security_model"><a class="anchor" 
href="#_security_model"></a>Security Model</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The <a href="https://tika.apache.org/security-model.html";>Apache Tika 
Security Model</a> describes the
+trust boundaries and assumptions that govern how Tika processes content. 
Understanding it
+is essential for deploying Tika securely.</p>
+</div>
+<div class="sect2">
+<h3 id="in-process-dos"><a class="anchor" 
href="#in-process-dos"></a>In-Process Parsing and Denial of Service</h3>
+<div class="paragraph">
+<p>If you call <code>AutoDetectParser</code> — or any parser — directly, the 
parse runs on your thread and
+in your heap. Untrusted input can often be crafted to exhaust memory or CPU, 
or to crash the
+process, and containing that is the caller&#8217;s responsibility: the project 
does not view denial
+of service as a security issue when you opt out of the built-in sandboxing and 
parse files
+directly in your application. Tika&#8217;s limits 
(<code>output-limits.writeLimit</code>,
+<code>embedded-limits.maxCount</code>, the metadata limiter) bound what a 
parse <strong>produces</strong>, not the work
+it does to produce it.</p>
+</div>
+<div class="paragraph">
+<p>The sandboxing that changes this is process isolation, and it is a 
mechanism rather than
+advice. <a href="pipes/index.html" class="xref page">Tika Pipes</a> — or 
<code>PipesForkParser</code>, if you are embedding Tika
+in a Java application — along with <a href="using-tika/server/index.html" 
class="xref page">tika-server</a> and
+<a href="using-tika/grpc/index.html" class="xref page">tika-grpc</a>, parse in 
forked JVMs. A parse that OOMs,
+hangs, or crashes takes down a fork, not your process: the fork is killed and 
restarted,
+and the caller gets <code>OOM</code>, <code>TIMEOUT</code>, or 
<code>UNSPECIFIED_CRASH</code> (HTTP <code>503</code> from tika-server)
+in place of a lost JVM. Give the forks a heap ceiling 
(<code>pipes.forkedJvmArgs</code>) and a
+timeout (<a href="pipes/timeouts.html" class="xref page">Timeouts</a>) so a 
runaway parse is bounded in both dimensions.</p>
+</div>
+<div class="admonitionblock important">
+<table>
+<tr>
+<td class="icon">
+<i class="fa icon-important" title="Important"></i>
+</td>
+<td class="content">
+The boundary is conditional, not blanket. A document that defeats 
<strong>Pipes' own</strong>
+limits — escaping the memory, timeout, or process bounds that sandboxing is 
supposed to
+enforce — is a bug in Tika, and the project does treat that as a security 
issue. Report it
+privately to <a href="mailto:[email protected]";>[email protected]</a>, not 
in a public issue.
+</td>
+</tr>
+</table>
+</div>
+</div>
+<div class="sect2">
+<h3 id="_tika_server_and_grpc_trust_model"><a class="anchor" 
href="#_tika_server_and_grpc_trust_model"></a>Tika Server and gRPC Trust 
Model</h3>
+<div class="admonitionblock important">
+<table>
+<tr>
+<td class="icon">
+<i class="fa icon-important" title="Important"></i>
+</td>
+<td class="content">
+Neither <code>tika-server</code> nor <code>tika-grpc</code> is a security 
boundary. They perform no
+authentication or authorization of callers, and parsing untrusted documents is 
inherently
+risky. Only ever expose them to <strong>trusted callers</strong> on a trusted 
network — never directly to
+untrusted users or the public internet. Put your own authentication, 
authorization, and
+network controls (and, for tika-grpc, mutual TLS) in front of them.
+</td>
+</tr>
+</table>
+</div>
+<div class="paragraph">
+<p>The capability flags below are <strong>defense in depth, not security 
boundaries</strong>: they limit what
+a caller can reach, but they do <strong>not</strong> make it safe to expose 
the service to untrusted
+callers — that requirement stands regardless of how the flags are set. All 
default to off.</p>
+</div>
+<div class="paragraph">
+<p><strong>tika-server</strong> (see <a href="using-tika/server/index.html" 
class="xref page">Using Tika Server</a>):</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><code>allowPipes</code> gates the <code>/pipes</code> and 
<code>/async</code> endpoints (process-isolated fetching and parsing
+through your fetchers/emitters). Selecting either without it causes the server 
to refuse to start.</p>
+</li>
+<li>
+<p><code>allowPerRequestConfig</code> gates per-request parser configuration — 
the <code>/config</code> endpoints and the
+multipart <code>config</code> part; when off, such requests are rejected with 
HTTP 403.</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p><strong>tika-grpc</strong> is <strong>more exposed by default</strong> than 
tika-server: it ships with no transport security and
+no per-caller authorization, and its <code>FetchAndParse</code> surface is 
always on. <code>allowPerRequestConfig</code>
+and <code>allowComponentManagement</code> — the latter lets clients add, 
modify, and delete fetchers/iterators
+and read back stored configs, which can contain secrets — are off by default. 
Run it only behind
+network controls and, ideally, mutual TLS. See <a 
href="using-tika/grpc/index.html" class="xref page">Tika gRPC</a>.</p>
+</div>
+<div class="paragraph">
+<p>For the upgrade from the former <code>enableUnsecureFeatures</code> flag, 
which is now split into
+<code>allowPipes</code> and <code>allowPerRequestConfig</code>, see
+<a 
href="migration-to-4x/migrating-tika-server-4x.html#_pipes_and_async_require_allowpipes_per_request_config_requires_allowperrequestconfig"
 class="xref page">Migrating tika-server to 4.x</a>.</p>
+</div>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_known_vulnerabilities"><a class="anchor" 
href="#_known_vulnerabilities"></a>Known Vulnerabilities</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Known CVEs in Apache Tika and their remediation are listed on the
+<a href="https://tika.apache.org/security.html";>Apache Tika security 
page</a>.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_external_command_security"><a class="anchor" 
href="#_external_command_security"></a>External Command Security</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Three components can be configured to run external system commands:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><code>FileCommandDetector</code> — uses the system <code>file</code> 
command for MIME type detection</p>
+</li>
+<li>
+<p><code>ExternalParser</code> — executes configured external programs to 
extract content</p>
+</li>
+<li>
+<p><code>ExternalEmbedder</code> — uses external tools to embed content</p>
+</li>
+</ul>
+</div>
+<div class="admonitionblock caution">
+<table>
+<tr>
+<td class="icon">
+<i class="fa icon-caution" title="Caution"></i>
+</td>
+<td class="content">
+External command configuration should only be performed by trusted 
administrators.
+Never allow untrusted users to configure command paths or arguments.
+</td>
+</tr>
+</table>
+</div>
+<div class="sect2">
+<h3 id="_security_best_practices"><a class="anchor" 
href="#_security_best_practices"></a>Security Best Practices</h3>
+<div class="ulist">
+<ul>
+<li>
+<p><strong>Restrict configuration access</strong>: only administrators should 
be able to modify Tika
+configuration files that specify external commands.</p>
+</li>
+<li>
+<p><strong>Use absolute paths</strong>: configure external commands with 
absolute paths to prevent PATH
+manipulation attacks.</p>
+</li>
+<li>
+<p><strong>Sandbox execution</strong>: run Tika in a container or sandbox to 
limit the impact of any
+command execution vulnerability.</p>
+</li>
+<li>
+<p><strong>Audit command configuration</strong>: regularly review configured 
external commands and their
+arguments.</p>
+</li>
+</ul>
+</div>
+</div>
+<div class="sect2">
+<h3 id="_externalparser_specific_risks"><a class="anchor" 
href="#_externalparser_specific_risks"></a>ExternalParser-Specific Risks</h3>
+<div class="ulist">
+<ul>
+<li>
+<p><strong><code>checkCommandLine</code> runs at type-query time</strong>: if 
configured, the check command executes
+the first time <code>getSupportedTypes()</code> is called, not at parse time — 
so merely querying
+which parsers are available triggers process execution.</p>
+</li>
+<li>
+<p><strong>stderr information leakage</strong>: external programs often write 
file paths, system
+usernames, version strings, and internal errors to stderr. 
<code>returnStderr</code> defaults to
+<code>false</code> for that reason; enabling it stores the raw stderr content 
in the document&#8217;s
+metadata, where end users may see it.</p>
+</li>
+<li>
+<p><strong>Buffer limits</strong>: <code>maxStdOut</code> and 
<code>maxStdErr</code> bound how much process output is held in
+memory. Set them for your deployment so a misbehaving external program cannot 
exhaust it.</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="_credential_handling"><a class="anchor" 
href="#_credential_handling"></a>Credential Handling</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Tika stores some credentials as Java String objects, which remain in memory 
until garbage
+collected. For environments with strict security requirements:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><strong>Use environment variables</strong> for credentials rather than 
configuration files where possible.</p>
+</li>
+<li>
+<p><strong>Use secret managers</strong> — HashiCorp Vault, AWS Secrets 
Manager, or similar — in production.</p>
+</li>
+<li>
+<p><strong>Enable encryption</strong>: <code>HttpClientFactory</code> can hold 
credentials AES-encrypted
+(<code>credentialsAESEncrypted</code>), with the key supplied in the 
<code>AES_KEY</code> environment variable.</p>
+</li>
+<li>
+<p><strong>Minimize credential scope</strong>: use credentials with the 
minimum necessary privileges and
+rotate them regularly.</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+</article>
+  </div>
+</main>
+</div>
+<footer class="footer">
+  <p>© Apache Software Foundation. All rights reserved.</p>
+</footer>
+<script id="site-script" src="../../_/js/site.js" 
data-ui-root-path="../../_"></script>
+<script async src="../../_/js/vendor/highlight.js"></script>
+<script src="../../_/js/vendor/lunr.js"></script>
+<script src="../../_/js/search-ui.js" id="search-ui-script" 
data-site-root-path="../.." data-snippet-length="150" 
data-stylesheet="../../_/css/search.css"></script>
+<script async src="../../search-index.js"></script>
+  </body>
+</html>

Reply via email to