This project is a single PowerShell script with no compiled dependencies. Only the latest released version on the main branch receives security updates.

Please report security vulnerabilities privately before opening a public issue.

Preferred channel: GitHub's private vulnerability reporting feature.

1. Go to the Security tab of the repository: https://github.com/raphaol/code-ps-backup/security
2. Click Report a vulnerability.
3. Provide a clear description, reproduction steps, and (if possible) a fix suggestion.

You should expect an initial response within 7 days. If the report is accepted, a fix will be issued on main and credited in the commit message unless you request otherwise.

Please do not open a public GitHub issue for suspected security vulnerabilities, and please do not attempt to exploit the vulnerability past the minimum needed to demonstrate impact.

This policy applies to:

• code-ps-backup.ps1 (the backup/restore script)
• Files under .github/
• Repository configuration (Settings, branch protection, webhooks, GH Actions)

Out of scope:

• Vulnerabilities in third-party tools this project backs up (Claude Code, Codex CLI, OpenCode, etc.) -- report these to their respective vendors.
• Secrets (API keys, tokens, passwords) found in your own backup repository. This tool is designed so that backups stay private to the user; secrets accidentally committed to a user's private backup repo are the user's responsibility. Use git rev-list --all --source -S 'secret-value' to search history and git filter-repo to scrub.

This repository has the following GitHub security features enabled:

Push protection blocks any commit containing recognized secret patterns (AWS keys, GitHub PATs, etc.) from being pushed to this repository.