Security fixes target the latest public release line.

Report security issues privately through GitHub Security Advisories for bbingz/polycli.

Please include:

• affected package or host plugin
• version or commit
• reproduction steps
• expected impact
• any relevant logs with secrets removed

Do not open a public issue for vulnerabilities involving credentials, local auth material, provider transcripts, or private repository data.

polycli invokes upstream provider CLIs as subprocesses and reuses local provider auth/config. It should not collect, upload, or host API keys. Public fixtures, docs, and package tarballs must not include maintainer-local paths, auth metadata, encrypted provider payloads, or provider reasoning signatures.