| Version | Supported |
|---|---|
| Latest | Yes |
picokit is a zero-dependency Go library providing small utility packages. Security concerns include:
- Path traversal when resolving file paths or arguments
- Unsafe file operations via untrusted input
- Dependency vulnerabilities in external packages
If you discover a security vulnerability, please report it responsibly:
- Do not open a public issue
- Use GitHub's private vulnerability reporting
- Include steps to reproduce and the affected function/version
- Allow reasonable time for a fix before public disclosure
This project uses:
- CodeQL for static analysis (Go)
- Gitleaks for secret scanning
- OpenSSF Scorecard for supply chain security
- SHA-pinned GitHub Actions to prevent supply chain attacks
- Dependabot for automated dependency updates