react-compiler-cli reads source code from the user's machine and, in --deep mode, spawns a Node helper. That footprint makes responsible disclosure worth a few explicit notes.

Only the latest minor of the 0.x line receives security fixes while the project is pre-1.0. Pin to an exact version in production and upgrade proactively.

Please do not open a public GitHub issue for security problems.

Preferred channel: open a private security advisory on the repository. That keeps the report encrypted end-to-end with the maintainer and lets us coordinate a fix and release before disclosure.

Alternative: email sergi@arbolparts.com with subject react-compiler-cli security. Include:

• Affected version(s) and installation method (npm i -g, cargo install, source build).
• A minimal reproducer — ideally a public repo or a small tarball.
• Impact assessment (what an attacker can read, modify, execute).
• Any suggested remediation you already have in mind.

You should receive an acknowledgement within 72 hours. If you do not, please ping again — mails occasionally get misrouted.

• Day 0 — report received, acknowledged.
• ≤ 7 days — triage complete, severity assigned, fix scoped.
• ≤ 30 days — fix released (faster for high-severity issues).
• +14 days after release — public advisory published, credit given to reporter (unless anonymity requested).

High-severity issues (remote code execution, arbitrary file write, data exfiltration) take priority over the calendar.

• The Rust binary, the npm wrapper, the MCP server, and the bundled Node bridge.js helper used for --deep.
• Any crafted fixture (config file, source file, tsconfig, monorepo manifest) that causes the tool to panic, hang, leak memory, or execute arbitrary code.
• Supply-chain issues in our release pipeline (unsigned artifacts, provenance gaps, compromised sub-packages).

Out of scope: vulnerabilities in babel-plugin-react-compiler itself (report upstream) and in unmodified direct dependencies on their latest published versions.

• The tool never sends telemetry and does not make outbound network requests. If you observe one, treat it as a security incident.
• --deep mode executes node_modules/babel-plugin-react-compiler from the scanned project. Only run it against trees you trust — a malicious node_modules can run arbitrary code via Node module resolution.
• The npm package is published with provenance — verify with npm install react-compiler-cli --foreground-scripts=false and check the provenance badge on the package page.