Security fixes are accepted for the latest released version of dbt-spec-kit. Older versions may be patched when a fix is low-risk and clearly applicable.
Do not open a public issue for a suspected security vulnerability.
Email the maintainers at open-source@duckcode.ai with:
- affected version or commit
- reproduction steps
- impact assessment
- any suggested fix
You should receive an initial response within 5 business days.
dbt-spec-kit is a local CLI and markdown asset package. The CLI should not collect telemetry, phone home, or require hosted services. Report any behavior that violates that expectation.