Please do not open a public issue for security problems.

1. Use GitHub Security Advisories on this repository, or
2. Contact the maintainer privately via their GitHub profile: axcel-blade.

Include:

• Description of the issue
• Steps to reproduce
• Affected version (cargo run --release -- --version)
• Impact assessment if known

You should receive an acknowledgment within a reasonable time. Please allow time for investigation before any public disclosure.

• DevKit downloads third-party SDK archives (Flutter, Temurin, Mono, Composer, Git for Windows / MinGit, GNU Make, Chocolatey CLI, Gradle, JUnit, PMD, PHP, MySQL, Node.js, Android cmdline-tools / platform-tools / NDK, Python, Go, Rust, .NET, CMake, Ninja, Maven, PostgreSQL, SQLite, kubectl, Terraform, npm, Yarn, pnpm, Deno, Bun, uv, Anaconda, Docker CLI). Only use trusted networks when installing.
• On Windows, GNU Make is the Chocolatey make 4.4.1 package, unpacked into the DevKit install folder. DevKit does not run an elevated choco install.
• Plugins may modify user environment variables (Windows registry or shell profiles).
• Review plugin code before running install on untrusted forks.