If you discover a security vulnerability in SetupSentry, please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities.

Instead, please email security concerns to the maintainers. If no dedicated email is available, use GitHub's private vulnerability reporting feature.

We will acknowledge receipt within 48 hours and provide an initial assessment within 7 days.

SetupSentry is a static analysis tool. Security issues may include:

• Bypasses that allow dangerous patterns to go undetected
• False positives that could cause users to ignore real findings
• Code execution vulnerabilities in the scanner itself

• Findings about third-party tools or dependencies
• Vulnerabilities in scanned repositories (use the scanner to detect these)

SetupSentry is a complementary tool. Always:

• Review setup instructions before execution
• Use dependency lock files
• Verify downloaded scripts before running them
• Use HTTPS for all remote downloads
• Prefer official package registries