Please don't open a public issue for security problems. Report them privately through GitHub's private vulnerability reporting instead.

Include what you found, how to reproduce it, and what it could affect. You'll get a reply as soon as possible.

Only the latest release gets fixes.

The ⚠ on risky commands is a reading aid, not a security boundary. It checks a short list of common spellings, so a command can be risky without getting one. A missed command is a regular bug: please open a normal issue for it.