Skip to content

SECURITY.md

Latest commit

 

History

History
30 lines (21 loc) · 1002 Bytes

SECURITY.md

File metadata and controls

30 lines (21 loc) · 1002 Bytes
Raw

Security Policy

Supported Versions

Version Supported
1.x.x ✅ Yes

Reporting a Vulnerability

Please do not open a public GitHub issue for security vulnerabilities.

Instead, please report them via GitHub Security Advisories.

Include:

  • Description of the vulnerability
  • Steps to reproduce
  • Impact assessment
  • Any suggested fix

You will receive an acknowledgement within 48 hours and a resolution timeline within 7 days.

Security Model

  • All shell commands use spawn/execFile with shell: false to prevent injection
  • User-supplied arguments are sanitised through sanitizeArg() before use in commands
  • Path traversal is prevented via validatePath() checks
  • No credentials or tokens are ever logged
  • Git hooks are written with minimal required permissions (0755)
  • The extension never executes arbitrary code without explicit user confirmation