safe-install is a security tool, so bypasses are bugs we take seriously.

Please do not open a public issue for a vulnerability or detection bypass. Use GitHub's private reporting: Security → Report a vulnerability on this repository.

Include what you ran, what you expected safe-install to catch, and a minimal reproduction (a harmless package that demonstrates the bypass is ideal, never real malware).

We aim to acknowledge reports within 3 days and to publish a fix and advisory once a patched release is available.

Only the latest release receives fixes.