We release patches for security vulnerabilities. Currently supported versions:

If you discover a security vulnerability, please do the following:

1. DO NOT create a public GitHub issue
2. Email security concerns to: rama@procsolve.com
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Critical vulnerabilities: 24 hours
• High severity: 72 hours
• Medium/Low: 1 week

• No runtime dependencies (zero attack surface)
• Development dependencies regularly audited
• Automated security scanning via GitHub Actions

• TypeScript with strict mode enabled
• Input validation on all user inputs
• No execution of arbitrary code
• File operations limited to specific directories

• Published with provenance attestation
• 2FA enabled on npm account
• Package integrity verified via npm signatures

1. Always install from npm registry: npm install cc-enhance
2. Verify package integrity: npm audit
3. Keep the package updated
4. Report suspicious behavior immediately

Security updates are released as patch versions and announced via:

• GitHub Security Advisories
• NPM security updates
• Repository releases page