The current minor release is supported with security fixes.

Report suspected vulnerabilities privately through GitHub's security advisory interface when available. Do not include secrets, private repositories, or malicious archives in a public issue.

Shipcheck parses data files only. It does not execute scanned repositories, load JavaScript configuration, extract ZIP entries, or access paths outside the selected project root. ZIP inspection enforces entry-count, central-directory, entry-name, compression-method, and uncompressed-size limits. It rejects encrypted archives, symlink entries, unsafe paths, and unsupported ZIP structures.

These controls reduce exposure to malformed input but do not prove that an archive is safe. Shipcheck is not an antivirus product, dependency scanner, or complete supply-chain defense.

Runtime code intentionally has no third-party dependencies. GitHub Actions use official actions at explicit major versions; this permits compatible security updates but is less immutable than a full commit SHA.