Please do not open a public issue for vulnerabilities that could expose command output, bypass patch fingerprinting, or allow arbitrary command execution beyond commands explicitly configured by the user.

Use GitHub's private vulnerability reporting for this repository. Include a minimal reproduction, affected version, and expected impact. You should receive an acknowledgement within 72 hours.

Shipreceipt executes commands explicitly supplied by the user or stored in the repository's .shipreceipt/config.json. Reviewing that file is part of reviewing a patch. The tool is not a sandbox and does not make untrusted commands safe.