Security fixes are applied to the latest stable release of FreshClone.

Please do not post exploit details in a public issue. Use GitHub's private vulnerability reporting feature for this repository when available.

FreshClone is intentionally local-first and has no backend, account system, API keys, analytics SDK, or telemetry endpoint.

• File analysis is read-only unless the user explicitly chooses a fix that creates .env from a template.
• Existing .env files are never overwritten.
• Terminal commands are never launched without a user action.
• Command-based checks are disabled in VS Code Restricted Mode.
• The extension does not execute project scripts during a scan.
• The extension does not upload source code, file contents, env values, or scan results.

Because extensions run with the permissions of VS Code, users should install FreshClone only from the official Marketplace listing or official GitHub releases.