Please report vulnerabilities privately, through GitHub's private vulnerability reporting: report a vulnerability (Security, Advisories, Report a vulnerability). Please don't open a public issue. You'll get an answer within a week, and the fix and advisory are published together.

In scope: the CLI (init, sync, check and what they write into a repository), the shared ESLint, Prettier and tsconfig configurations, and the workflows. Vulnerabilities in ESLint, Prettier or their plugins belong upstream.