Before the first public release, the default branch is the only supported code line. After release, security fixes will target the latest published minor version.

Do not open a public issue for a vulnerability that could expose user data, enable code execution, bypass local-only processing, or compromise generated package artifacts.

Use GitHub’s private vulnerability reporting for the future repository:

https://github.com/aminhanifm/LockSignal/security/advisories/new

Include:

• Affected version and surface (API, CLI, browser, packaging, or documentation)
• Minimal reproduction using synthetic data
• Expected and observed behavior
• Potential impact
• Suggested mitigation, if known

Please avoid including private lockfiles, registry credentials, tokens, or sensitive URLs. A maintainer will acknowledge a complete report as soon as practical and coordinate remediation and disclosure.

LockSignal is designed to:

• Parse lockfiles as data
• Compare values deterministically
• Render escaped evidence
• Read browser files in memory
• Avoid network requests, registry queries, telemetry, and browser storage
• Avoid installing analyzed dependencies or executing package scripts

The CLI can read user-selected paths and write a user-selected report path. --output uses exclusive creation unless --force is supplied.

LockSignal is not a vulnerability scanner. A report is not evidence that a package is safe or malicious. Users remain responsible for reviewing package code, provenance, advisories, and organizational policy.

Lockfiles can contain private registry hostnames and resolved URLs. Exported reports intentionally include changed source evidence when it explains a finding. Review and redact a report as appropriate before sharing it outside the intended audience.