Do not open public issues for security vulnerabilities.

If you discover a security vulnerability, please email aflesler@gmail.com with:

• Description of the vulnerability
• Steps to reproduce or proof of concept
• Potential impact
• Suggested fix (if any)

• Acknowledgment within 48 hours
• Assessment of the vulnerability's severity and impact
• Timeline for a fix and release
• Credit in the release notes (unless you prefer to remain anonymous)

Security considerations for scip-cli include:

• Index integrity: SCIP indexes are read from local filesystem and trusted
• SQL injection: All queries use parameterized statements
• Path traversal: File operations are scoped to the indexed project
• Dependency security: Minimal dependencies; pinned versions in pyproject.toml

• Install from PyPI: pip install scip-cli (verified releases)
• Keep scip-cli updated to the latest version
• Review .scip-cli.json configuration before use in untrusted projects
• The scip binary is downloaded from official releases

We appreciate responsible disclosure and will work with you to understand and address the issue promptly.