Security, with clear boundaries.

PatchWRK Scanner performs bounded, read-only static analysis. It does not execute scanned repository code or make network requests during scanning. Scan a stable checkout: portable filesystem checks are not a race-proof sandbox against a concurrently hostile filesystem.

Reports describe discovered evidence and uncertainty. They are not a production compatibility guarantee or security certification.

Vulnerability reporting

Send confidential vulnerability reports to security@patchwrk.dev. The founder has tested incoming delivery and folder routing through Cloudflare Email Routing to a verified dedicated Yahoo inbox. Forwarding is inbound-only; outbound branded email is not yet configured. GitHub private vulnerability reporting is NOT YET ENABLED. Do not post credentials, private source code, or sensitive vulnerability details in public issues.

Supported versions

The current v0.x beta is supported on a best-effort basis. Older versions receive no guaranteed security backports. No response times or support commitments are promised.

Include affected versions, impact and a minimal synthetic reproduction. Do not send secrets or private customer source. Email forwarding is not an end-to-end encrypted reporting channel. For particularly sensitive material, first request an agreed secure transfer method without attaching exploit details. Restricted handling, secure replies and backup responder procedures still require owner review before public launch.