# Security

## Reporting a vulnerability

If you discover a security issue in this repository, please open a **private** security advisory on GitHub if the project is hosted there, or contact the maintainer directly. Do not file public issues for undisclosed vulnerabilities.

## Credentials and process visibility

This CLI forwards commands to the official Contentstack CLI (`csdx`). Like any local CLI, **command lines may be visible** in process listings on the machine (e.g. `ps`, activity monitors, CI logs). Avoid passing secrets as raw argv when possible; prefer environment variables or interactive prompts provided by `csdx` where applicable.

## Scope

`@timbenniks/contentstack-xzibit` is a thin local wrapper: it does not run a hosted service or collect telemetry by default. Review `csdx` and your stack’s own security guidance for API tokens, management tokens, and delivery keys.