If you discover a security vulnerability in JTcli, please do not open a public issue.

Instead, report it privately by emailing jwhna1@gmail.com with:

• A description of the vulnerability and its potential impact.
• Steps to reproduce, ideally including a minimal example or a captured network trace.
• The JTcli version (or commit hash), Windows build, and how you started the affected session (SSH / SFTP / proxy / deploy wizard).
• Any relevant logs from <exe>/config/logs/. Strip credentials before sharing.

You can expect an initial response within 5 business days. We will work with you on a coordinated disclosure timeline once the issue is confirmed.

In scope:

• The JTcli desktop client (jtcli.exe) and its bundled jtUI framework.
• The SSH / SFTP transport, host-key verification, proxy chain, known-hosts handling, and credential storage on the local machine.
• The one-click deploy orchestrator and recipe execution paths.
• Crash handler and log writer (memory dumps and log files may contain sensitive data).

Out of scope:

• Vulnerabilities in third-party libraries (libssh2, vcpkg, Windows SDK) that have already been disclosed upstream — please report those to the corresponding maintainers.
• Issues that require a compromised local machine or local administrator privileges.
• Social-engineering reports against the maintainers themselves.

Only the latest v1.x release line receives security fixes.

Thank you for helping keep JTcli and its users safe.

如果你在 JTcli 中发现安全漏洞，请不要在 public issue 中公开。

请通过邮件私下汇报至 jwhna1@gmail.com，并附上：

• 漏洞描述与潜在影响范围。
• 复现步骤，最好附一段最小可复现示例或抓包文件。
• 触发漏洞的 JTcli 版本（或 commit hash）、Windows 版本，以及触发场景（SSH / SFTP / 代理 / 一键部署）。
• 必要时附 <exe>/config/logs/ 里的相关日志，提交前请清除其中的凭据信息。

我们承诺在 5 个工作日内首次响应。漏洞确认后会与你一起协商披露时间表。

在范围内：

• JTcli 桌面客户端（jtcli.exe）及其内置的 jtUI 框架。
• SSH / SFTP 传输、host key 校验、代理跳板、known_hosts 处理、本机凭据存储。
• 一键部署的编排器与 recipe 执行链路。
• 崩溃捕获与日志写入逻辑（dump 与日志可能包含敏感信息）。

不在范围内：

• 第三方库（libssh2、vcpkg、Windows SDK）的已公开披露漏洞，请直接报给上游维护者。
• 需要本机已被攻陷或具备本地管理员权限才能触发的问题。
• 针对维护者个人的社会工程类报告。

仅最新的 v1.x 发布线接收安全修复。

感谢你帮助保障 JTcli 与其用户的安全。