PothiPath is built and maintained by a single person in their personal time. Security reports are taken seriously, but please be patient — there is no on-call rotation.

This is a solo project. Older versions are not patched unless the issue is critical and reproduction is trivial.

Please do not file public GitHub issues for security bugs.

Instead, report privately by email:

📧 vishwakarmaliokamesh1998@gmail.com

Use the subject line [SECURITY] <short summary> and include:

• Affected tool / repository
• Affected version or commit SHA
• A minimal reproduction (commands, inputs, expected vs. actual)
• Impact assessment (what can an attacker do, who is affected)
• Whether you want public credit when the fix lands

• Acknowledgement within 7 days.
• Triage within 14 days — severity assigned, fix scope decided.
• Fix timeline — critical issues fixed before the next release; lower severity may be batched.
• Disclosure — coordinated with you. Default: public disclosure 30 days after fix or when you agree, whichever comes first.

• Code execution from untrusted input in any PothiPath tool
• Secret / API key leakage in code, logs, or default config
• Path traversal, SSRF, or injection in CLI / API surfaces
• Local privilege escalation in PothiChat (Electron) or any desktop tool
• Anything in the published npm / pip packages that didn't come from the corresponding public source

• Issues in third-party dependencies (file upstream)
• Social engineering, phishing, or anything targeting the maintainer directly (use the email above; do not post publicly)
• Theoretical findings without a working PoC

If you'd like credit in the fix commit and the release notes, say so in the report. I keep a SECURITY.md-style acknowledgment section updated as fixes ship. This is a thank-you, not a paid bounty program.

Thank you for keeping PothiPath users safe.