If you discover a security vulnerability, please report it responsibly:

1. Do NOT open a public issue.
2. Email kan.fushihara@gmail.com with:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
3. You will receive an acknowledgment within 48 hours.
4. A fix will be released as soon as possible, typically within 7 days.

Release artifacts (the Windows installers, the portable zip, and the macOS .dmg) carry GitHub Artifact Attestations in releases after v0.62.0. To confirm that a file you downloaded was built from this repository by the release workflow, run:

gh attestation verify Pike_X.Y.Z_x64-setup.exe --repo kan/pike \
  --signer-workflow kan/pike/.github/workflows/release.yml

In-app updates are verified separately, against the minisign public key embedded in the app.

The following are in scope:

• XSS / code injection via rendered content (markdown preview, file icons, etc.)
• Command injection via shell spawning, git CLI, or search execution
• Path traversal in file system or project operations
• Tauri IPC privilege escalation
• Supply chain risks in bundled binaries

Out of scope:

• Denial of service
• Attacks requiring physical access to the machine
• Social engineering
• Vulnerabilities in upstream dependencies (report to the upstream project instead)