This is a template repository. There's no running service and no version to track. Each fork or "Use this template" copy becomes its own independent workspace from the moment it's created, and a fix made here only reaches copies made afterward.

An unsafe hook configuration, a credential-handling gap, a permissive default in .claude/settings.json. Use GitHub's private security advisories so the fix lands before it propagates into someone's fork.

Open a public Issue. The content is already public, so speed matters more than privacy here. Do not include the leaked content in the report; link to the file and line.

• Vulnerabilities in Claude Code itself: report to anthropics/claude-code.
• Issues in your own fork after you've customised it — that's your workspace to secure from there.

Private security advisories get a first response within a week. If you don't hear back in two weeks, open a new private advisory as a ping.

Last verified against the repo structure on 2026-08-28.