Please do not open a public issue for security problems. Use GitHub's private vulnerability reporting for this repository, and include steps to reproduce.

We aim to acknowledge reports within 3 business days.

Only the latest released version receives security fixes.

DevShield reads project files and never executes project code. Reports of the tool running untrusted code, writing outside the scanned project, or leaking secrets it finds are in scope.