Only the latest release on PyPI gets security fixes.

Please report it privately through the repository's Security tab ("Report a vulnerability"). If that option is not available, open an issue that asks for a private contact, without any details of the problem.

Useful to include: the since-cutoff version, the command or MCP tool call, and the package or project that triggers the problem.

since-cutoff reads untrusted input: package archives from PyPI, model answers, and the project it scans. It is designed never to import or execute package code or model-written code: package sources are read statically (only .py/.pyi files are extracted, with path and size checks), and model answers are only type-checked. A way to make it execute such code, write files other than its cache, its reports (.since-cutoff/ or the paths you give) and the marked AGENTS.md/CLAUDE.md block, or send your source code to a model provider is a vulnerability.