Please report suspected vulnerabilities privately through GitHub Security Advisories at https://github.com/excelano/slipql/security/advisories/new. If you would rather not use GitHub, email david.anderson@excelano.com instead. I aim to respond within seven days.

Please do not open public issues for security problems.

The latest release receives security fixes. Older versions are not supported.

slipql is a CLI that runs locally on your machine. It lists the directory you name, opens every file there whose extension is .slpc, reads the metadata member out of each through the slpc library, and closes it. It never decompresses or reads a payload, never writes to any file it scans, makes no network calls, has no auth layer, and implements no administrative operations. It can only read files your operating-system user already has access to.

The metadata member is decompressed before it can be parsed, so a container is a claim on memory before it is known to be one. The slpc library bounds that read, and a container over the bound is skipped and reported rather than read. A program embedding the library sets the bound through Options.

slipql stores nothing outside the files you explicitly redirect output to. The interactive prompt keeps a line-editing history file under your configuration directory (~/.config/slipql/ on Linux and macOS, %APPDATA%\slipql\ on Windows); there is no other state, no telemetry, no analytics, and no remote logging.

Every GitHub release includes a .sha256 file next to each archive listing its SHA-256 hash. Verify any download before running it:

sha256sum slipql-x86_64-unknown-linux-gnu.tar.xz
# compare against the value in slipql-x86_64-unknown-linux-gnu.tar.xz.sha256

Release artifacts are built by GitHub Actions from a tagged commit using the cargo-dist configuration in this repo (dist-workspace.toml and the generated .github/workflows/release.yml). The workflow and build configuration are public and auditable.