Please report security issues privately through GitHub Security Advisories rather than as a public issue.

Expect an acknowledgement within 72 hours and an assessment within seven days.

The latest minor release receives security fixes. This project is pre-1.0.

ghosttest reads files and prints text. Its attack surface is small by construction, and the following are in scope:

• Code execution while scanning. Nothing in a scanned project should ever be executed — not source, not test files, and specifically not config files. vitest.config.ts is a TypeScript module that can do anything, and it is parsed as text for exactly that reason.
• Denial of service. A crafted file or tree that makes a scan hang or exhaust memory. The glob compiler is the place to look: it turns user-supplied patterns into regular expressions, so a pattern that compiles to catastrophic backtracking would be a genuine finding. Directory depth and file size are bounded, and node_modules is never walked.
• Report injection. Output that lets a scanned file forge a finding — terminal escape sequences in a test title or a file path that rewrite the screen.
• Path traversal. A construction that gets the walker to read outside the directory it was given.

• A wrong census. A miscounted test or a misjudged collection rule is a correctness bug and a genuinely useful report, but it is not a security issue. Please open a normal issue.
• Vulnerabilities in projects ghosttest scans. ghosttest is not a security scanner; it counts tests.

• No network access. There is none anywhere in the tool.
• Nothing is executed. No project code, no test files, no config module. The runner is never invoked — which is also why ghosttest works on a repository whose dependencies are not installed.
• Read-only. ghosttest never writes to the project it scans.
• Zero runtime dependencies. Installing it does not widen your supply chain.
• No install script.
• Bounded reads. Files above 4 MB are skipped, directory descent is capped at 24 levels, and build output directories are never walked.