Security fixes target the latest deployed version of get.rpath.dev and the latest released version of rpath.
Please report suspected vulnerabilities privately to:
me@byjonas.dev
Do not open a public issue for vulnerabilities involving shell injection, installer tampering, checksum bypasses, PATH hijacking, unsafe file deletion, or unsafe environment mutation.
Please include:
- Affected script or route
- Affected operating system and shell
- Reproduction steps
- Expected and actual behavior
- Whether the issue requires local access
- Serve only reviewed installer and uninstaller scripts.
- Verify GitHub Release checksums before installing binaries.
- Install user-local files by default.
- Ask before shell wrapper installation unless explicitly configured.
- Keep normal
rpathrefresh behavior separate from networked install and upgrade flows.