# security policy

## supported versions

security fixes target the latest published version.

## reporting a vulnerability

open a private security advisory on github once the public repository exists, or contact the package maintainer directly before publication.

## scope

security-sensitive areas include branch-name validation, git argv construction, command failure handling, package contents, and any future network behavior.

branchout intentionally avoids shell interpolation, telemetry, credential storage, background services, force operations, stashing, resetting, rebasing, merging, and automatic commits.

see [docs/security-model.md](docs/security-model.md) for the command-level threat model.