Please do not open a public GitHub issue for security-sensitive reports.

Email the maintainer via the address on the GitHub profile, or open a private security advisory if available.

Include:

• Affected version (todo --version)
• Steps to reproduce
• Impact (data loss, path traversal, command injection, etc.)

You should receive an acknowledgement within a few days.

todo-cli is a local CLI:

• It does not phone home or send telemetry.
• Network use is limited to the optional Cursor SDK path (todo run / todo go --run) when you install todo-cli[agent] and set CURSOR_API_KEY.
• Task data lives on disk under your chosen data directory (todo where).

Treat your data directory and handoff files as sensitive if they contain secrets or proprietary context.

The following are out of scope for todo-cli 2.0 and the foreseeable local-first roadmap:

• Hosted API or cloud sync service
• Multi-user ACL / shared live queues over the network
• Web backend or SaaS dashboard (the GitHub Pages site is marketing + playground only)
• Bidirectional sync with GitHub Issues, Jira, Linear, or other issue trackers

Contributions that add these are likely to be declined unless they remain optional, offline, and vendor-neutral plugins.