Only the latest 1.x release receives security fixes.

Do not open a public issue for a suspected vulnerability. Report it privately to the repository maintainers with a minimal reproduction, affected version, impact, and suggested mitigation if available. Maintainers will acknowledge reports within seven days and coordinate disclosure after a fix is available.

DiffProof executes a test command supplied by the repository owner. That command is code execution. Run DiffProof only in repositories and CI contexts you trust, and never expose secrets to untrusted pull-request code. DiffProof uses an isolated temporary Git worktree to avoid editing the invoking checkout; it is not a sandbox for malicious tests.