We release patches for security vulnerabilities. Currently supported versions:

We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them via:

1. GitHub Security Advisories (preferred):

   • Go to Security Advisories
   • Submit a private vulnerability report

2. Email (alternative):

   • Create an issue at GitHub Issues indicating you have a security concern
   • A maintainer will provide a secure communication channel

Please include:

• Description of the vulnerability
• Steps to reproduce
• Affected versions
• Potential impact
• Suggested fix (if any)

• Initial response: Within 48 hours
• Status update: Within 7 days
• Resolution: Depends on severity and complexity

• Please do not disclose the vulnerability publicly until a fix is released
• We will credit you in the release notes (unless you prefer to remain anonymous)

When using The Pair:

• API Keys: Never commit your AI provider API keys to version control
• Workspace: Be aware of which directories you grant the app access to
• Permissions: Review the permissions requested by each Pair session
• Updates: Keep the app updated to the latest version

• The Pair executes AI-generated commands in your local environment
• Always review changes before accepting them in manual approval mode
• Use workspace-scoped permissions to limit file system access
• The app requires access to your opencode configuration for AI model access

Thank you for helping keep The Pair secure!