Security fixes are handled on the latest published version of @faruhe/tkcli.

Please report suspected vulnerabilities through GitHub Security Advisories if available, or by opening a private report with enough detail to reproduce the issue.

Useful details include:

• Affected command or template.
• Operating system and Node.js version.
• Exact command used.
• Expected behavior and actual behavior.
• Whether generated files, path traversal, dependency install, git operations, or Claude Code permissions are involved.

tk writes project files, may run git init, and may run dependency installation when the user opts in. The project aims to keep these boundaries clear:

• Stack names and component names are whitelist-validated.
• Template output paths are checked to prevent path traversal.
• Infra modules are add-only by default.
• Claude Code permissions are generated per stack instead of using a broad universal allow-list.
• Auto-sync hooks are opt-in and written to local settings.