Please do not open a public GitHub issue for security vulnerabilities.

Use one of these private channels:

• GitHub Private Vulnerability Reporting — click "Report a vulnerability" on the Security tab
• Email — hello@koteguard.com

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (optional)

You will receive an acknowledgement within 48 hours and a fix or mitigation plan within 7 days for critical issues.

KoteGuard handles:

• Git worktree isolation
• Sensitive file stubbing (.jks, google-services.json, .p12)
• Copilot CLI command generation with --deny-tool flags

Security issues in these areas are considered high priority.