If you find a security issue in deep-security-check itself — for example a way to make the skill write outside its output directory, execute code from a scanned project, or leak data off the machine — please report it privately.

• Open a GitHub security advisory, or
• email security@givegroup.it with the details and reproduction steps.

Please do not open a public issue for a suspected vulnerability. We aim to acknowledge reports within a few business days.

In scope: the skill's own scripts (scan.sh, score.py, surface.py, structure.py), the bundled ruleset, the vendored binary, and the CI workflow.

Out of scope: vulnerabilities in the third-party scanners the skill orchestrates (Semgrep, osv-scanner, gitleaks, trivy, syft) — report those to their respective projects. Findings the skill reports about your code are the expected output, not a vulnerability in the skill.

The latest released version receives fixes. This is a read-only defensive tool; see PRIVACY.md for its data-handling guarantees.