| Version | Supported |
|---|---|
| Latest | ✅ |
| < Latest | ❌ |
Only the latest released version of Commit+ receives security updates. Users are encouraged to always run the most recent release.
The Commit+ team takes security vulnerabilities seriously. We appreciate your efforts to responsibly disclose any issues you find.
Please do NOT report security vulnerabilities through public GitHub issues.
Instead, please report them via email to:
Please include the following information in your report:
- A description of the vulnerability and its potential impact
- Steps to reproduce the issue or a proof of concept
- The version(s) of Commit+ affected
- Any suggested fix, if applicable
- Acknowledgement: We will acknowledge receipt of your report within 48 hours.
- Assessment: We will investigate and confirm the vulnerability, then determine its impact and severity.
- Resolution: We will work on a fix and coordinate a release timeline.
- Disclosure: Once a fix is available, we will publicly disclose the vulnerability and credit the reporter (unless you prefer to remain anonymous).
This security policy applies to the Commit+ application (Commit-Plus/commit-plus). The following are out of scope:
- Vulnerabilities in the system Git executable itself
- Security issues in third-party dependencies (please report these to the respective maintainers)
- Social engineering attacks
- Always download Commit+ from official releases or build from source.
- Keep your macOS and system Git up to date.
- Be cautious when opening untrusted repositories, as they may contain malicious configuration files (e.g.,
.gitconfig, hooks).
This project is licensed under the GNU Affero General Public License v3.0. Security fixes will be released under the same license.