scriptspect is pre-1.0. No npm release has been published yet, so security fixes currently target the main branch. After publication, the latest npm release will be supported alongside main.

Use GitHub security advisories ("Report a vulnerability"). Please do not open public issues for vulnerabilities.

We aim to respond within 7 days. Include reproduction steps and the affected rule/module if known.

• scriptspect is a static analyzer: it never executes analyzed scripts (no child_process use against target projects) and reads only files inside the analyzed project root.
• The tool collects no telemetry and makes no network calls in normal operation.
• Never include secrets in reports; the project does not need them.