Before the first public preview, there is no publicly supported CLI version. After publication, security fixes are provided for the most recent published CommerceKit CLI version unless its release notes state otherwise.

Do not report suspected vulnerabilities in a public issue, pull request, or discussion.

Email commercekit.tools@gmail.com with the subject CommerceKit CLI security report. Include:

• the affected CLI version and platform;
• the release asset filename and whether its checksum matched SHA256SUMS;
• a concise description of the issue and its impact;
• reproducible steps or a minimal proof of concept; and
• a safe way to contact you for follow-up.

Do not include production credentials, customer data, proprietary project files, or third-party secrets. Remove or replace sensitive values before sending logs or examples.

Reports are reviewed privately. Please allow time to reproduce the issue, assess affected releases, and prepare remediation before public disclosure.

For non-security problems, use the public contact page at https://commercekit.tools/contact.