Security

Supported versions

Only the most recent version of chezmoi is supported with security updates.

Virus scanner false positives

Virus scanning software, especially on Windows machines, occasionally report viruses or trojans in the chezmoi binary. This is almost certainly a false positive.

For more information see Why does my virus-scanning software think my Go distribution or compiled binary is infected? in the Go FAQ.

Reporting a vulnerability

Please report vulnerabilities by opening a GitHub issue or sending an email to twpayne+chezmoi-security@gmail.com.