Report vulnerabilities in the CLI, or in the CleanSlop service it talks to, through GitHub's private vulnerability reporting: Security → Report a vulnerability on this repository. Please don't open a public issue.

We'll acknowledge your report, keep you updated while we work on a fix, and credit you if you'd like.

Only the latest release of @cleanslop/cli on npm gets security fixes.