We provide security updates for the following versions of coverage-runner:

We take security vulnerabilities seriously. If you discover a security issue, please follow these steps:

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Send an email to [email protected] with:

• A clear description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Any suggested fixes or mitigations

• Initial response: Within 48 hours
• Status update: Within 7 days
• Resolution: Depends on severity and complexity

1. We will acknowledge receipt of your report
2. We will confirm the vulnerability and determine its impact
3. We will develop and test a fix
4. We will release a patched version
5. We will publicly disclose the vulnerability with appropriate credit

coverage-runner executes test commands and processes coverage files. Be aware that:

• Test commands are executed in the working directory
• Coverage files are parsed and processed
• The --repo option clones and executes code from remote repositories

1. Review test configurations before running coverage-runner
2. Validate repository URLs when using the --repo option
3. Use trusted coverage files only
4. Run in isolated environments when analyzing untrusted repositories
5. Keep dependencies updated regularly

We regularly audit our dependencies for security vulnerabilities using:

• npm audit
• Dependabot security alerts
• Manual security reviews

This security policy applies to:

• The core coverage-runner package
• CLI interface and commands
• Configuration parsing and processing
• Test runner integrations
• Coverage file processing and merging

• Security issues in third-party test frameworks (Jest, Vitest, etc.)
• Issues in dependencies that don't affect coverage-runner
• General Node.js or npm security issues

When using coverage-runner:

1. Pin dependency versions in production
2. Use package-lock.json for reproducible builds
3. Audit dependencies regularly
4. Limit file system permissions where possible
5. Use CI/CD pipelines for automated security scanning

For security-related questions or concerns:

• Email: [email protected]
• Security advisories: https://github.com/NoritakaIkeda/coverage-runner/security/advisories

Thank you for helping keep coverage-runner secure!