Report any security vulnerabilities you find according to these guidelines.

• Please adhere to Code of Conduct at all times.

• If you discover a vulnerability, report it directly to the code maintainers, __preferably using GitHub's Private Vulnerability Reporting
• If you cannot find a way to report it, or have received no response after repeated attempts, contact the creators directly.

Thank you.

This project strives to implement Open Source Security Foundation (OSSF) Best Practices.

Some of the security measures undertaken in this project include:

• OSSF Scorecard
• Security file
• Security Insights Specification as defined in the Security Insights specification
• Security Self Assessment
• Security Dependencies Policy
• Software Bills Of Material (SBOMs) scanned by Trivy (Python vulnerabilities and licenses)
• GitHub artifact attestations (Sigstore-backed) of distributions, SBOMs and SARIF files, each verified against its producing workflow before being attached to the release
• Static analysis and vulnerability scanning in CI, before every release and weekly, with results uploaded to the GitHub Security tab:
  • CodeQL (GitHub Actions workflows)
  • zizmor (GitHub Actions workflows)
  • Semgrep
  • uv audit (dependencies)
  • GuardDog (malicious runtime dependencies and actions)
• Protected main branch (rulesets) with required status checks
• GitHub Actions CI/CD pipelines with minimal permissions (write permissions only in dedicated upload and attestation jobs)
• GitHub Actions CI/CD pipelines hardened via Harden Runner
• Prek hooks for local code quality and security verification