Security fixes are applied to the current npm release of dsh-ticktick. Older releases may not receive a backport.

Do not open a public issue for a vulnerability. Use GitHub's private vulnerability reporting on https://github.com/PerryLink/dsh-ticktick/security/advisories/new, or email the maintainer listed in package.json if private reporting is unavailable.

Include the affected version, a minimal reproduction, and the impact. We aim to acknowledge a report within 7 days; this is a best-effort community project, not a 24/7 service.

This policy covers the code in this repository. It does not cover the DSH host, third-party language servers or services configured by the user.