Only the latest version on the main branch is actively supported.

Do not open a public issue for security vulnerabilities.

Instead, please report security issues through GitHub Security Advisories.

You will receive a response within 72 hours acknowledging the report. A fix will be developed and released as quickly as possible depending on severity.

For a dotfiles/configuration repository, security issues include:

• Leaked secrets: API keys, tokens, passwords, or private keys in configuration examples or templates
• Unsafe defaults: Configuration that weakens security posture when applied (e.g., disabling TLS verification, overly permissive file modes)
• Hook bypasses: Ways to circumvent the protective hook scripts (scan-secrets.sh, protect-files.sh, block-dangerous-commands.sh)
• Code injection: Template content that could lead to command injection when processed by shell scripts or GitHub Actions
• Credential exposure: Install or uninstall scripts that inadvertently expose credentials or sensitive paths

• Bug reports for non-security functionality (use regular issues)
• Feature requests
• Style or documentation issues
• Pre-commit hook failures on valid content

We follow coordinated disclosure. After a fix is released, the advisory will be published with full details and credit to the reporter.