If you discover a security vulnerability in Git Watchtower, please report it responsibly:

1. Do not open a public GitHub issue for security vulnerabilities
2. Email the maintainer directly at drummel@gmail.com
3. Include a detailed description of the vulnerability
4. If possible, include steps to reproduce or a proof of concept

• You will receive an acknowledgment within 48 hours
• We will investigate and provide an estimated timeline for a fix
• Once fixed, we will credit you in the release notes (unless you prefer to remain anonymous)

This security policy covers:

• The git-watchtower npm package
• The source code in this repository
• The documentation site at https://gitwatchtower.dev

Git Watchtower:

• Executes git commands on your local repository
• Optionally runs a local HTTP server for live reload
• Optionally executes custom dev server commands specified in your config

Always review your .watchtowerrc.json configuration, especially the server.command field, as it will be executed as a shell command.