Please do not open a public issue for security vulnerabilities.

Report privately to: 1770669041@qq.com

Include: affected version(s), impact, reproduction steps or proof of concept, and any suggested mitigation. You will get an acknowledgement within 72 hours.

In scope: the cloudcode / cloud-code CLI, the @cloud-code/* packages, and the release binaries distributed from this repository.

Please note that Cloud Code CLI executes commands and edits files on behalf of the user by design — report only behaviors that exceed the granted permission scope (e.g. sandbox escapes, credential disclosure, command injection through untrusted content).

OAuth credentials and API keys are stored under ~/.cloud-code/ with user-only permissions. Never commit files from that directory to any repository.