If you discover a security vulnerability in Pactwork, please report it responsibly:

1. Do not open a public issue
2. Report via GitHub Security Advisories
3. Include a description of the vulnerability
4. Allow time for a fix before public disclosure

We take security seriously and will respond promptly.

Pactwork:

• Uses execFile (not exec) to prevent shell injection when invoking subprocesses
• Does not execute user-provided code
• Reads and writes only to specified directories
• Disables external $ref resolution in the OpenAPI parser to prevent unintended network requests (SSRF). Only local file references are resolved.