The latest released version receives security fixes.

Do not publish an exploitable archive, path traversal, arbitrary file write, or unsafe shading case before maintainers can respond. Use the repository's private security-advisory feature when available. Otherwise, open a minimal issue that requests a private contact and omits exploit details.

Include the DevTools version, server/API version, operating system, relevant manifest/config, the smallest safe reproduction, expected destination, and observed destination. Never include credentials or private server data.

DevTools treats plugin and virion source as trusted development code when it is eventually loaded by PHP. Metadata inspection, building, and extraction still avoid executing source. Builds do not access the network. Staging and extraction reject symbolic links, ambiguous namespaces, non-portable archive paths, and destination escape. Existing build outputs require explicit overwrite; extraction prepares a sibling tree before atomically installing it with backup/restore.