TokenWatcher reads local files under your home directory (see the README “Privacy & safety” section). It is not designed to handle untrusted project directories as a sandboxed threat boundary.

Please do not open a public GitHub issue for active exploits or sensitive vulnerability details.

1. Open a GitHub Security Advisory for this repository (preferred), or
2. Contact the maintainer through a private channel if one is listed on their GitHub profile.

Include enough detail to reproduce or understand the impact (version/commit, platform, minimal steps). We will aim to acknowledge reasonable reports, subject to maintainer availability.