If you discover a security vulnerability in GPC, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, use GitHub's private vulnerability reporting.

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Acknowledgment: Within 48 hours
• Initial assessment: Within 1 week
• Fix and disclosure: Within 30 days for critical issues

Fixes ship in a new release. Upgrade with gpc update, npm install -g @gpc-cli/cli@latest or brew upgrade gpc. See Versioning and Stability for what each release type can contain.

See Security documentation for details on:

• Credential storage and handling
• Secrets redaction in output
• Network security
• Dependency policy
• Plugin permission model