Do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities privately via email: security@gabrielh.dev

Include in your report:

• Description of the vulnerability
• Steps to reproduce
• Potential impact (what an attacker could achieve)
• Any suggested remediation

We follow a 90-day coordinated disclosure timeline. After 90 days, we may publish details of the vulnerability regardless of whether a fix has been released, to protect the community.

This template contains:

• Shell scripts (.claude/hooks/*.sh, scripts/*.sh)
• Configuration files (.pre-commit-config.yaml, .claude/settings.json)
• Documentation and prompt files

In scope:

• Hooks that execute arbitrary commands with unintended side effects
• Configuration that grants excessive permissions
• Prompt injection vulnerabilities in agent definitions
• Scripts that handle sensitive data insecurely

Out of scope:

• Issues in third-party tools (Graphify, pre-commit, ruff, prettier) — report to those projects directly
• Social engineering attacks
• Theoretical vulnerabilities without a concrete exploit path

• Review .claude/settings.json permissions before using in a sensitive codebase
• Use claude --sandbox mode for untrusted projects
• Never commit .env files or credentials — use CLAUDE.local.md and .claude/settings.local.json (both gitignored) for local secrets
• Run gitleaks detect before pushing if you've added credentials during a session