If you find a security issue in dotbak, please do not open a public issue.

Instead, email darshithedpara@gmail.com with:

• A description of the vulnerability
• Steps to reproduce (if possible)
• Any suggested fix (optional)

I'll respond as soon as I can and will credit you in the fix (unless you prefer to stay anonymous).

dotbak is a local CLI tool that manages dotfiles on your machine. It does not run a server or handle network traffic directly. The main security-relevant areas are:

• Self-update (dotbak update): downloads from GitHub Releases with mandatory SHA256 verification
• File operations: symlinks, copies, and archive creation in user-owned directories
• Shell execution: dotbak is a compiled bash script — no eval or dynamic code execution