Frameshift is pre-release software. No version has been released, and no supported production release line exists. The CLI currently provides help and version output only.

Do not disclose suspected vulnerabilities, credentials, private project source, or exploit details in public issues or pull requests. Once private vulnerability reporting is enabled, use Report a vulnerability. If that form is unavailable during the visibility transition, contact the repository owner privately; do not post the vulnerability publicly. No response-time commitment is made.

Include the affected commit or version, expected and actual behavior, impact, and a minimal fictional reproduction. Remove credentials and personal information. Do not upload third-party project source.

See docs/SECURITY.md for implemented controls, planned controls, the threat model, known limitations, and the publication checklist. Planned controls are not security guarantees. Frameshift does not detect malware or secrets inside analyzed source code.