cli-kit is released as v0.x. Security fixes go into the latest minor release only; please upgrade to it before reporting.

If you have discovered a vulnerability, please reach out privately via email to opensource@mittwald.de instead of opening a public issue. Include the affected package, version, and a description or proof of concept. We will acknowledge your report and keep you informed about the fix.

Packages that handle secrets (secret) or replace executables (selfupdate) are especially sensitive; reports about them are very welcome.