ReinstallKit handles filesystem paths, generated PowerShell, and application installation commands. Security reports in these areas are taken seriously.

The current main branch is the supported development version. Older commits and third-party forks may not receive fixes.

Use GitHub private vulnerability reporting for this repository:

https://github.com/DenisGeide/ReinstallKit/security/advisories/new

Do not open a public issue for an exploitable path traversal, command injection, unsafe generated script, or credential exposure before the maintainer has had a reasonable chance to investigate.

Include:

• affected commit or version;
• exact reproduction steps using non-sensitive fixture data;
• expected and actual behavior;
• affected command, manifest field, or path;
• a minimal proof of concept when useful.

Never attach a real recovery bundle, usernames, personal paths, tokens, browser data, password stores, or private filenames. Replace them with a small synthetic fixture.

The following behaviors are considered security-sensitive:

• importing or exporting paths outside the expected bundle;
• following symlinks or Windows reparse points during copy operations;
• executing arbitrary command text or shell expressions;
• accepting malformed winget IDs as executable arguments;
• restoring credential stores without explicit handling;
• silently downloading or launching an installer;
• starting an install or restore immediately after manifest import.

See Generated Script Safety for the expected behavior of exported scripts.