Do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities to: security@squash.works

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested mitigations

We follow coordinated disclosure with a 90-day embargo from acknowledgement to public disclosure. We will acknowledge receipt within 48 hours and provide a remediation timeline within 7 days.

This action installs squash-ai from PyPI. The action itself contains no secrets or credentials; it only:

• Calls the squash-ai CLI
• Reads model files from the runner workspace
• Writes attestation artifacts to the runner workspace
• Optionally signs with Sigstore (no private keys stored)

The api-key input is passed only via environment variable and never logged.