If you discover a security vulnerability in behave-doctor, please report it responsibly.
- Email: mathias@paulenko.dev
- Do not open a public GitHub issue for security vulnerabilities.
We aim to acknowledge reported vulnerabilities within 48 hours and to provide a fix or mitigation according to severity.
behave-doctor is a read-only static analysis tool. It does not execute code,
make network calls, or write to the filesystem beyond user-requested output
files. However, it does parse Python source files via ast.parse and read
.feature files from disk. Vulnerabilities related to parsing untrusted
.feature or .py files, path traversal in project scanning, or regex
denial-of-service in step pattern compilation are in scope.