SlashIt is pre-1.0 software. Security fixes are currently provided for the latest release and the main branch.

Please do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities privately, either through GitHub's private vulnerability reporting (the Report a vulnerability button on this repository's Security tab) or by emailing admin@barradev.com. Include:

• A concise description of the issue
• Steps to reproduce or a proof of concept, if available
• Affected platform and version
• Any suggested mitigation

You should receive an acknowledgement within 7 days. We will coordinate remediation privately, publish a fix when available, and credit reporters when requested and appropriate.

Security reports are especially helpful for:

• Unsafe command execution or shell injection
• Local privilege escalation
• Unauthorized filesystem access
• IPC socket abuse or authentication bypass
• Update signing, release, or distribution issues
• Leaks of secrets, credentials, or private workspace data

Please give maintainers a reasonable amount of time to investigate and release a fix before public disclosure.