The project is early. Security fixes are most likely to land on the latest release and main.

Please do not open a public issue for a security problem.

Use GitHub's private security reporting flow for this repository:

• Report a vulnerability

If the issue involves command execution, path resolution, secret handling, or unsafe verification commands, include:

• the exact command or profile involved
• whether the problem requires a malicious repository, profile, or prompt
• what the attacker can gain
• any known workaround

You should receive an acknowledgment after the report is reviewed.