Only the latest 0.x release receives security fixes while the project is in early development. Once a 1.0 ships, this section will be updated to list which versions are supported.

Please do not open a public GitHub issue for security problems.

Use GitHub's private vulnerability reporting: https://github.com/TechPreacher/weather-receipts/security/advisories/new

Include:

• A description of the issue and its impact.
• Steps to reproduce, ideally with a minimal example.
• The version, commit hash, or release tag affected.
• Any suggested mitigation, if you have one.

You should receive an initial acknowledgement within a few business days. We will work with you on a fix and coordinated disclosure timeline.

In-scope:

• The CLI, the library code under src/, and the published npm package.
• ESC/POS output that could damage a printer if crafted maliciously (e.g. unbounded write loops, infinite-cut commands).

Out of scope:

• Vulnerabilities in Open-Meteo's APIs themselves — please report those upstream.
• Issues that require already-compromised local user privileges (the CLI runs with the user's own permissions and reads/writes their config file by design).