If you believe you found a security issue, please do not open a public issue with exploit details.

Preferred options:

• Open a GitHub Security Advisory (private) if the repository has it enabled.
• Otherwise, open a minimal public issue that says “security report” and ask maintainers for a private channel.

bazelcode is a harness that can run commands (git, rg, bazel) against a repository. Treat it as code execution tooling:

• Avoid running it against untrusted repositories.
• Review any patches before applying them.