Cleaner is currently experimental.

Security fixes will generally target the current development version.

Please do not open a public GitHub issue for a suspected security vulnerability.

Instead, contact the maintainer privately through the security contact method configured for the repository.

Include:

• a clear description of the vulnerability
• affected version/commit
• reproduction steps
• expected behavior
• actual behavior
• potential impact

If possible, include a minimal reproduction.

Cleaner is a source transformation tool.

Security reports involving unintended file modification, path traversal, arbitrary command execution, malicious configuration handling, or unsafe processing of untrusted source code are especially important.

Please report these privately.

The maintainer will evaluate the report, reproduce the issue where possible, and determine an appropriate remediation and disclosure timeline.