Please report vulnerabilities privately via GitHub Security Advisories ("Report a vulnerability" on the repository's Security tab). Do not open a public issue for anything security-relevant.

You can expect an acknowledgement within a few days. Please include the version/build stamp printed at startup and, if possible, a reproduction.

This tool changes security configuration on remote hosts over SSH with sudo. Bugs that matter most, in order:

1. Anything that lets plan data (which originates from audited, potentially compromised hosts) reach a remote shell or a spreadsheet cell unescaped.
2. Anything that applies a change without the operator's approval, or that misreports what was applied.
3. Anything that defeats the sshd guard (backup, sshd -t, watchdog, fresh session probe) or the rollback path.

SSH and sudo passwords are read from a prompt or an environment variable and passed over stdin. They must never appear in argv, logs, results files or reports. Report any leak of this kind as a vulnerability.