Security fixes are handled on the default branch first. Tagged releases may receive follow-up fixes when practical.
| Version | Supported |
|---|---|
| Latest release | Yes |
| Older releases | Best effort |
Please do not open a public issue for security vulnerabilities.
Use GitHub's private vulnerability reporting feature when available:
- Open the repository on GitHub.
- Go to Security.
- Select Report a vulnerability.
If private reporting is not available, contact the repository owner through the GitHub profile and include:
- A short summary of the issue.
- Steps to reproduce.
- Affected files, commands, or report outputs.
- Any suggested mitigation.
Good reports include problems such as unsafe file handling, command injection risks, incorrect license policy classification that can hide prohibited dependencies, or generated reports that expose sensitive local data unexpectedly.
General license policy disagreements, feature requests, and false positives can be opened as normal issues.