Please report security issues privately through GitHub Security Advisories rather than as a public issue.

Expect an acknowledgement within 72 hours and an assessment within seven days.

The latest minor release receives security fixes. This project is pre-1.0.

aliascheck reads files and prints text. Its attack surface is small by construction, and the following are in scope:

• Code execution while scanning. Nothing in a scanned project should ever be executed. Sources are read as text; package.json scripts are matched as strings and never run.
• Denial of service. A crafted file or directory tree that makes a scan hang or exhaust memory — catastrophic regular-expression backtracking in the specifier scanner, a symlink arrangement that defeats the depth limit, or an extends chain that loops. Directory depth, file size and extends depth are all bounded, and the chain detects its own cycles.
• Path traversal. Resolution of extends walks up looking for node_modules. A construction that gets it to read somewhere unexpected is in scope.
• Report injection. Output that lets a scanned file forge a finding — terminal escape sequences from a file path or an import specifier that rewrite the screen.

• A missed rewriter, or a false positive. These are correctness bugs and genuinely useful reports, but they are not security issues. Please open a normal issue.
• Vulnerabilities in projects aliascheck scans. aliascheck is not a security scanner; it checks module resolution.

• No network access. There is none anywhere in the tool.
• Nothing is executed. No project code, no build scripts, no config module — tsconfig.json is parsed as data, which is also why the parser is hand-written rather than delegated to a runtime require.
• Read-only. aliascheck never writes to the project it scans.
• Zero runtime dependencies. Installing it does not widen your supply chain.
• No install script.
• Bounded reads. Files above 2 MB are skipped, directory descent is capped, and node_modules is never walked.