Security fixes are applied to the latest published version of tsc-staged.

Report suspected vulnerabilities through GitHub private vulnerability reporting.

Include the affected version, steps to reproduce the issue, its potential impact, and any suggested mitigation. Do not open a public issue or pull request for an undisclosed vulnerability.

GitHub CodeQL scans JavaScript and TypeScript changes on pull requests and pushes to main. This automated check supplements security reports. It does not guarantee that the package is free of vulnerabilities.