OpenCodeKit is pre-1.0. Security fixes are applied to the latest release on the main branch; older releases may not receive backports.

Please report suspected vulnerabilities privately through the repository's Security → Report a vulnerability flow:

https://github.com/zynx-real/opencodekit/security/advisories/new

Include the affected version, operating system, reproduction steps, impact, and any suggested mitigation. Do not include real credentials or private repository contents. You should receive an acknowledgement within seven days.

Please do not open a public issue until a fix or coordinated disclosure plan is available.

Reports involving repository confinement, command permissions, credential storage, secret exposure, prompt-to-tool authorization boundaries, dependency compromise, or unsafe session persistence are especially valuable.