Only the latest published release receives security fixes.

Please use GitHub's Report a vulnerability / Private Vulnerability Reporting feature for this repository. Do not open a public issue for path-boundary bypasses, unintended deletion, privilege escalation, command injection, or sensitive log exposure.

Include:

• CDriveCare version and Windows version;
• the affected cleanup rule;
• a minimal reproduction using disposable test data;
• the expected and actual path boundary;
• whether a junction, symlink, mount point, race, or environment-variable change is involved.

Never upload logs that expose usernames, personal paths, machine names, or private file names without redacting them first.

High-priority security issues include:

• deletion outside the selected rule root;
• traversal through a Reparse Point;
• deletion of a protected system or personal directory;
• command argument injection;
• reporting a failed cleanup as successful;
• writing logs outside the documented per-user log directory.
• accepting update metadata or download links outside the fixed CDriveCare GitHub repository;
• publishing a Release whose tag, executable version, checksums, or source commit do not match.