The Tuist repo is scanned frequently for code and dependency vulnerabilities. Notifications are received by the Tuist Core Team members, who assess risk, prioritize, and determine a remediation plan. Typically this process involves a package update or patch release and is resolved within 24 hours of notification.

If you discover a potential security issue, do let us know as soon as possible. We'll work toward a resolution as quickly as possible, so please provide us with a reasonable amount of time before disclosure to the public or a third-party.

Contact us at pedro@tuist.io

Thank you for helping improve Tuist security!

We take security seriously. Which is why we offer a friendly reminder that "Tuist Framework Security" != "Security of Applications built with Tuist"

It's our responsibility (Core Team members) to implement security best practices and make the framework as secure as possible. We will do as much as we can; however, we can only do so much. Ultimately, security rests in the hands of the application developers who use Tuist. If you haven't already, we recommend starting the security process for your application with GitHub's Security Tools and Best Practices.