Feature Track is a lightweight documentation workflow and CLI. It should not require secrets or privileged access.

Please report security issues privately to the maintainers instead of opening a public issue.

Until a dedicated security contact is published, use the GitHub repository's private vulnerability reporting feature when available.

Security-sensitive areas include:

• CLI behavior that writes outside the requested project root.
• Installer behavior that overwrites user files unexpectedly.
• Markdown or path handling that could modify files outside the intended target.

Feature Track installers should preserve existing user files by default. If a target file or directory exists, the tool should skip it, create a merge file, or require an explicit backup option.