# Security Policy
## Supported Versions
| 0.1.x | Yes |
## Reporting a Vulnerability
If you discover a security vulnerability, please report it responsibly:
1. **Do not** open a public issue
2. Use [GitHub's private vulnerability reporting](https://github.com/BeepBoopBit/plk/security/advisories/new)
3. Or email the maintainer directly
We will acknowledge receipt within 48 hours and aim to release a fix within 7 days for critical issues.
## Security Considerations
- **Shell hook**: `plk _record` is called on every command. It only appends to a local log file and does not transmit data anywhere.
- **History log**: Stored in `~/.local/share/plk/history.log`. Contains your command history and working directories. Protect this file with appropriate permissions.
- **Executor**: `plk run` and `plk auto` execute commands via `$SHELL -c`. Only run shortcuts you trust.
- **Config files**: Review shortcuts in `shortcuts.json` before sharing them.