Security fixes are provided for the latest published version.

Please report security issues privately by opening a GitHub security advisory or by contacting the package maintainer through the repository's security channels.

Do not include secrets, private target content, raw agent logs, or generated findings in public issues.

reviewer runs locally and invokes the agent command configured by your working directory. Target content, target IDs, ruleset prompts, tool output, and review findings may be sent to that configured agent/provider.

The package does not operate a hosted service. Data exposure depends on your configured agent command, provider, rulesets, and logs/artifacts you choose to store or share.

Reviewer does not use Git as a core dependency, does not install Pi packages, and does not write report directories during review. It also does not provide an OS sandbox for the configured agent command; use a trusted command and environment.

Use verbose/debug logging carefully: raw agent or RPC payloads may contain target content, local paths, tool output, prompts, or secrets if your agent/tooling reads them.