Please report security vulnerabilities through GitHub Security Advisories (private disclosure).

Do not open a public issue for security vulnerabilities.

• Acknowledgment: within 48 hours
• Patch target: within 7 days for confirmed vulnerabilities

dev-proxy is a local development tool — it is not designed or intended to be deployed as production infrastructure. Certain design decisions reflect this:

• Self-signed TLS certificates are generated intentionally for local HTTPS development
• rejectUnauthorized: false is used by design to proxy to local dev servers with self-signed certs
• The TUI inspector displays request/response data on the local terminal only

Security reports should focus on vulnerabilities that could affect developers using the tool in their local environment (e.g., arbitrary code execution, credential leakage, supply chain risks).