paw is a personal dotfiles manager driven by paw.toml. It creates symlinks, installs packages, and can run lifecycle hook command strings with user permissions. Only use dotfiles repos you trust.

If you discover a security vulnerability in paw's core logic (path traversal, command injection, etc.), please report it responsibly:

1. Do not open a public GitHub issue
2. Email the maintainer or use GitHub's private vulnerability reporting
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

Security concerns that are in scope:

• Path traversal in symlink creation or scaffold output
• Command injection through package names or hook arguments
• Backup/restore bypasses that could overwrite protected files
• Self-update mechanism vulnerabilities (binary verification, MITM)

Security concerns that are out of scope:

• Malicious hook commands in paw.toml — hooks are user-controlled and run with full permissions by design
• Anything requiring physical access to the machine
• Social engineering

• Path validation ensures symlinks and scaffolded files stay within allowed directories
• Package names are validated to prevent shell injection
• Original files are backed up before being overwritten
• Dry-run mode (--dry-run) lets you preview all changes before applying