If you discover a security vulnerability in this project, do not open a public issue.

Please report it privately by contacting:

• GitHub: @Crypt0xDev via Security Advisories
• Email: contact via GitHub profile

• A clear description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (optional)

You will receive a response within 72 hours. Critical issues will be patched as soon as possible.

• The script clones external repositories and executes their install.sh. Only install themes from trusted sources.
• Review any community or custom theme's install.sh before running it.
• The script runs with your user privileges — it does not require root unless your theme's own installer does.

• The web app is a static/SSR Next.js application with no user authentication or database.
• No user input is stored or processed server-side.
• All external links use rel="noopener noreferrer".

Once a fix is released, the vulnerability will be publicly disclosed via a GitHub Security Advisory.