Please don't report security vulnerabilities in public issues, discussions or pull requests.

Instead, report them privately through GitHub. Go to the Security tab of this repository and click "Report a vulnerability". Only the maintainers can see your report.

Please include:

• the lazygit version (the output of lazygit --version) and your operating system
• the steps to reproduce the problem, ideally as a script that sets up a repository
• what an attacker can achieve with it

Lazygit is maintained by volunteers in their spare time. We can't promise a fixed response time, but we'll get back to you as soon as we can.

If we confirm the vulnerability, we fix it in private and release a new version. Then we publish a security advisory, request a CVE for it through GitHub, and credit you in the advisory unless you prefer not to be named.

We only fix security vulnerabilities in the latest release. Please check whether the problem still exists there before you report it.