Please do not disclose security vulnerabilities in a public issue.

Report vulnerabilities privately through GitHub's Report a vulnerability feature on the repository's Security tab. If private vulnerability reporting is not available, contact the maintainer through the GitHub profile without including vulnerability details and request a private reporting channel.

Include a description of the issue, affected versions, reproduction steps, and the potential impact. You should receive an acknowledgement within seven days.

Security reports about credential handling, unintended write operations, sensitive-data disclosure, dependency vulnerabilities, and command execution are welcome. The upstream Arccos services are operated by Arccos Golf LLC and are outside this project's control; report vulnerabilities in those services to Arccos directly.

Credentials are written atomically with owner-only permissions. Users who prefer not to store access keys in a file can install the keyring extra and enable operating-system keyring storage.

OpenTelemetry is disabled unless a caller imports and instruments a client or invokes otel-export. Request telemetry uses sanitized endpoint templates and never attaches credentials, bearer tokens, email addresses, user IDs, query values, or response bodies. Golf metrics use bounded window and club dimensions. The --include-history option is privacy-sensitive because it emits round IDs and played dates as span events; it is off by default.

Security fixes are applied to the latest release. Users should upgrade to the most recent published version before reporting an issue that may already have been corrected.