Please do not open a public issue for a vulnerability that could put users or their source code at risk. Use GitHub's private vulnerability reporting for this repository when available, or contact the maintainer through the address listed on the npm package.

Include reproduction steps, affected versions, and the likely impact. You can expect an acknowledgement within seven days.

Trimference reads source files from the requested local path. The scanner does not upload source or call an AI provider. Package installation through npm and use of GitHub Actions still involve those services under their respective policies.