dev-cost-estimator is distributed from the main branch and published to npm. Security fixes are applied to the latest released line only.

Please do not open public GitHub issues for security problems.

Report privately via either channel:

1. GitHub Private Vulnerability Reporting (preferred) — on this repository, go to the Security tab → Report a vulnerability. This keeps the report confidential until a fix is released.
2. Email — security@buske-consulting.de with the subject prefix [security] dev-cost-estimator.

Please include:

• affected version (npx dev-cost-estimator --version),
• a description of the issue and its impact,
• minimal steps to reproduce (a sample repo or .costmodel.json if relevant),
• any suggested remediation.

Response targets (best effort, this is a maintained side project):

• acknowledgement within 5 business days,
• an initial assessment within 10 business days,
• a fix or mitigation plan communicated before any public disclosure.

We support coordinated disclosure: please give us a reasonable window to ship a fix before publishing details. Reporters are credited in the release notes unless you ask to remain anonymous.

dev-cost-estimator is a local, zero-dependency CLI. It:

• runs git ls-files / git rev-parse HEAD in the target directory (constant commands; user input is passed only as the working directory, never interpolated into a shell string),
• reads git-tracked source files to count lines,
• reads an optional .costmodel.json configuration file,
• writes a .costmodel/ report directory.

It performs no network requests, uses no runtime dependencies, and does not execute eval/dynamic code.

Because the tool runs with the privileges of the user who invokes it and reads that same user's configuration file, the configuration file (.costmodel.json) is trusted input: a maliciously crafted regular-expression pattern in your own config can cause excessive backtracking (ReDoS) against your own process. Do not run the tool against a .costmodel.json you have not reviewed and do not trust.

In-scope reports include, for example:

• shell command injection via repository paths, file names, or CLI arguments,
• path traversal that reads or writes files outside the target directory through untrusted (non-config) input,
• a way for an untrusted repository under analysis to execute code or escape the read-only analysis sandbox.

Out of scope:

• ReDoS or path traversal achievable only by supplying your own malicious .costmodel.json (trusted input, see above),
• denial of service from pointing the tool at an extremely large repository,
• issues in Node.js, git, or the user's environment itself.

npm view dev-cost-estimator dist.integrity   # SHA-512 of the published tarball
npm publish --dry-run                         # inspect exact files in a build