garnish is pre-1.0. Only the latest release line receives fixes.

Please report security issues privately rather than opening a public issue. Use GitHub's private vulnerability reporting on this repository, or email antoine@neveux.me.

Include enough detail to reproduce (affected version, inputs, expected vs actual). You can expect an acknowledgement within a few days and a coordinated fix and disclosure once a patch is available.

garnish is a terminal UI library. The most relevant concerns are untrusted candidate text (it is rendered, never executed) and resource use on very large inputs. Note that terminal backend and rendering live in Tamboui, not garnish.