The latest released minor version receives security fixes. Please upgrade to the most recent release before reporting an issue.

Please do not open a public issue for security problems.

Instead, use GitHub's private vulnerability reporting: Report a vulnerability. This keeps your report confidential to the maintainers until a fix is released.

Please include:

• A description of the issue and its impact.
• Steps to reproduce (a minimal proof of concept is ideal).
• Affected version(s) and platform.

We aim to acknowledge reports within 72 hours and to provide a remediation timeline after triage. We will credit reporters in the release notes unless you prefer to remain anonymous.

dep-regret is a local tool with a small threat surface. A few things worth knowing for your own model:

• Network: by default, dep-regret makes read-only HTTPS requests to public package registries (npmjs.org, pypi.org, crates.io, proxy.golang.org) to look up install sizes and dependency counts. It sends only the package name. Run with --offline to make zero network requests.
• No code execution. dep-regret reads and parses manifest files; it never installs, builds, or executes package code.
• API keys for the optional inline --apply feature are read from environment variables (ANTHROPIC_API_KEY, OPENAI_API_KEY) and are never written to disk by dep-regret.
• Shell hooks. dep-regret guard --install modifies your shell rc file inside clearly-marked # >>> dep-regret guard >>> fences. The file is written atomically and a .dep-regret.bak backup is saved first. Remove the hooks at any time with dep-regret guard --uninstall, or by deleting the block by hand.
• The hooks fail open. The installed npm/pip/cargo/go wrappers run your real package manager in every case except an explicit interactive "no". If dep-regret is missing, errors, or the shell is non-interactive (CI, scripts), your install proceeds normally — the guard will never silently break your toolchain.