Please do not open a public GitHub issue for security-sensitive reports.

Email the maintainer via the address on the GitHub profile, or open a private security advisory if available.

Include:

• Affected version (todo --version)
• Steps to reproduce
• Impact (data loss, path traversal, command injection, etc.)

You should receive an acknowledgement within a few days.

todo-cli is a local CLI:

• It does not phone home or send telemetry.
• Network use is limited to the optional Cursor SDK path (todo run / todo go --run) when you install todo-cli[agent] and set CURSOR_API_KEY.
• Task data lives on disk under your chosen data directory (todo where).

Treat your data directory and handoff files as sensitive if they contain secrets or proprietary context.