Do not open public issues for security vulnerabilities. The Apache 2.0 license disclaims warranty, but credible reports are still worth fixing privately first.
Use GitHub's private vulnerability reporting on this repository:
- Go to the Security tab at the top of the repo page
- Click Report a vulnerability
- Fill out the form — the maintainer is notified privately and can coordinate disclosure with you
If GitHub's vulnerability reporting is unreachable for any reason, open a minimal placeholder issue without sensitive details and request a private channel.
Only the latest released version is supported with security fixes. Pre-release versions and source builds from master are not separately patched — track master for fixes.
- Reports are acknowledged within 7 days
- Fixes are coordinated privately
- Public disclosure follows the release that contains the fix
LocalDevelopmentStack is a code-generation CLI. The vulnerability surface most likely concerns:
- Generated
docker-compose.yml— credentials, exposed ports, container privilege boundaries - Generated
Dockerfile.dev— supply-chain risks via base images - CLI input handling — path traversal, command injection via
--name,--output, or--existing-dir
Issues in the upstream Docker images (e.g. postgres:16, mysql:8) should be reported to those projects directly. If our usage of an upstream image creates a downstream issue — insecure default config, deprecated tag, weakened healthcheck — report here.