We actively support the following versions with security updates:

Recommendation: Always use the latest stable release from the Releases page.

We take security vulnerabilities seriously. If you discover a security issue, please follow responsible disclosure:

DO NOT open a public GitHub issue for security vulnerabilities.

Instead, report via:

1. GitHub Security Advisories (Preferred):

   • Go to Security → Advisories
   • Click "Report a vulnerability"
   • Provide details using the template below

2. Email (Alternative):

   • Contact: [your-email@example.com]
   • Subject: [SECURITY] bash-markdown-link-validator vulnerability
   • Use PGP key (if available): [link to PGP key]

## Vulnerability Description
[Clear description of the security issue]

## Impact
[Potential impact: data exposure, code execution, etc.]

## Steps to Reproduce
1. Step 1
2. Step 2
3. ...

## Proof of Concept
[Code snippet, logs, or screenshots]

## Suggested Fix
[Optional: Your recommendation for fixing the issue]

## Environment
- Version: [e.g., v1.1.0]
- OS: [e.g., Ubuntu 22.04]
- Bash Version: [output of `bash --version`]

Note: Timelines may vary based on complexity and severity.

1. Keep Updated: Use the latest stable release
2. Review Code: Inspect scripts before running in sensitive environments
3. Least Privilege: Run with minimal necessary permissions
4. Input Validation: Be cautious with untrusted Markdown files

1. No Secrets: Never commit credentials, tokens, or sensitive data
2. ShellCheck: Run shellcheck to catch common vulnerabilities
3. Input Sanitization: Always validate and sanitize user inputs
4. Dependency Security: Minimize dependencies (we have zero!)

• Risk: Scripts read files from the file system
• Mitigation: Run in controlled environments, use --exclude for sensitive dirs

• Risk: Validates HTTP(S) links (no actual HTTP requests by default)
• Mitigation: JSON mode for CI/CD, avoid executing external code

• Risk: Shell injection if inputs are not sanitized
• Mitigation: All variables are quoted, no eval usage

We appreciate security researchers who help improve this project:

No security reports yet. Be the first!

For general security questions (not vulnerabilities):

• Discussions: GitHub Discussions
• Documentation: CONTRIBUTING.md

Thank you for helping keep bash-markdown-link-validator secure! 🔐