Security fixes are provided for the latest stable release of ast-grep. Please upgrade to the latest release before checking whether a suspected vulnerability is still present.
Please report suspected security vulnerabilities in ast-grep, including its CLI and language bindings, through GitHub's private vulnerability reporting form.
Do not disclose vulnerability details in public issues, discussions, or pull requests before maintainers have had an opportunity to investigate and address the report.
To help us assess your report, include:
- The affected ast-grep version, component, and operating system.
- A description of the vulnerability and its potential impact.
- Steps to reproduce the issue, ideally with a minimal proof of concept.
- Any suggested mitigation or fix, if available.
We will review the report and use the private reporting thread to discuss findings, request additional information, and coordinate any fix and public disclosure with you.
For bugs that do not have a security impact, please use the public issue tracker.