We actively maintain the latest release of SG CLI published on pub.dev. Security fixes are applied to the most recent version.

Please do not report security vulnerabilities through public GitHub issues.

SG CLI runs commands and writes files on developers' machines, so we take reports seriously. To report a vulnerability privately, use one of these channels:

1. GitHub Private Vulnerability Reporting — go to the Security tab of this repository and click "Report a vulnerability". This opens a private advisory visible only to maintainers.
2. SolGuruz contact — reach out through the contact options at solguruz.com and mention "SG CLI security report" so it reaches the right team quickly.

• A description of the vulnerability and its potential impact
• The SG CLI version affected (run dart pub global list)
• Steps to reproduce, or a proof of concept
• The command(s) involved, e.g. sg init, sg create screen, sg setup_firebase

• We will acknowledge your report as soon as we can.
• We will investigate and keep you informed of our progress.
• Once a fix is released, we will credit you in the release notes if you'd like (or keep you anonymous — your choice).

Thank you for helping keep SG CLI and its users safe.