Only the latest released version of ui-ux-pro-max-cli and the latest main branch of this skill receive security fixes.

Please do not open a public GitHub issue for security vulnerabilities.

Instead, report it privately using GitHub's private vulnerability reporting (Security tab → "Report a vulnerability").

Include as much of the following as possible:

• A description of the vulnerability and its potential impact
• Steps to reproduce (command, prompt, or CLI flags used)
• The version of ui-ux-pro-max-cli and the AI assistant/platform involved
• Any relevant logs or output

We aim to acknowledge reports within 5 business days and to provide a fix or mitigation timeline within 14 days for confirmed issues.

This project is a design-system generation skill: a Python search/CLI tool and static data (CSV/JSON) consumed by AI coding assistants. In-scope concerns include:

• Arbitrary code execution via the CLI installer or search scripts
• Path traversal or unsafe file writes when running uipro init / uipro uninstall
• Supply-chain issues in the ui-ux-pro-max-cli npm package or its release pipeline

Out of scope: the design output itself (colors, fonts, UI recommendations) is not a security surface.