Please do not open a public issue for security problems.

Use GitHub's private advisory form instead:

https://github.com/a-saeedia/node-code-mode/security/advisories/new

You can expect an acknowledgement within 72 hours. Please include reproduction steps, affected versions/commit, and any proof-of-concept you have.

Anything that lets an attacker read, modify, or destroy data this project is responsible for, or execute code it did not intend to execute.

• Findings that require the attacker to already control the machine or the account
• Dependency version bumps with no demonstrated exploit path
• Rate-limiting or denial-of-service reports without a concrete impact scenario