Please report vulnerabilities privately through GitHub private vulnerability reporting, not in a public issue. Include the script, its version (--version), the command you ran and what happened.

You will receive an acknowledgement within 7 days. Fixes are released as a new version and credited in the changelog unless you prefer otherwise.

The scripts follow a lightweight secure software development life cycle:

1. Requirements: no script may execute data it reads, modify files outside what the user selected, or publish anything without showing it first.
2. Design: a STRIDE threat model per tool, in docs/threat-model.md.
3. Implementation: the rules in CONTRIBUTING.md: no eval, no sourcing of data, argument arrays, validated input, -- before file names, private file permissions.
4. Verification: ShellCheck and 87 bats tests, including the injection and safety cases, run by CI on Ubuntu for every change.
5. Maintenance: GitHub Actions pinned by commit SHA, read-only workflow permissions and Dependabot updates.