Use GitHub's private vulnerability reporting on this repository (Security → Report a vulnerability). It is private by construction, which a public issue is not.

Please include what you did, what happened, and what you expected. A proof of concept helps; a working exploit is not required and you are not expected to build one.

Do not open a public issue for a vulnerability, and please do not test against a server you do not own.

Worth stating plainly, because the deployment shape decides most of the answer:

• The HTTP transport does not authenticate yet. It is safe on localhost and it is not safe on a LAN or any routable interface. Do not bind it to one. Authentication is tracked work, not an oversight, and this note exists so nobody discovers it by deploying first.
• The tools read the filesystem, sandboxed to --root. Absolute paths and .. traversal are rejected lexically; symlink and junction escapes are rejected by resolving the REAL path — every existing segment through ResolveLinkTarget — and requiring it to lie under the equally-resolved root (a link whose target stays inside the root still reads). Until 2026-08-19 this sentence was ahead of the code: the guard was lexical only, and a junction inside the root read straight through it; the real-path check and its escape tests closed that. Reads are capped in both lines and bytes so one call cannot pull an unbounded payload. --root is the security boundary: point it at the workspace you mean, never at a home directory or a drive root.
• There are no editing tools here. The public surface reads. That is a product boundary and also a security property, and it is asserted by a test.
• Telemetry is opt-in. Without --spool <path> nothing is written. When it is on, call arguments are recorded to a local file under a byte budget — so a directory you point it at inherits whatever sensitivity the arguments carry.

Pre-1.0 in practice — see VERSIONING.md. Fixes land on main; there are no maintained release branches, so the supported version is the current one.

Acknowledge the report, tell you whether we can reproduce it, and say what the fix is and when it lands. If we decide something is not a vulnerability, we will say why rather than close it silently. Credit in the release note if you want it, and no credit if you would rather not.