If you believe you've identified a security vulnerability in setup-node-pnpm (a bug that allows something to happen that shouldn't be possible), you can reach us at [email protected].

You will receive a response from us within 48 hours. If the issue is confirmed, we will release a patch as soon as possible depending on complexity but likely within a few days.

A "vulnerability in setup-node-pnpm" is a vulnerability in the code distributed through our main source code repository on GitHub. Vulnerabilities that are specific to a given installation (e.g. misconfiguration) should be reported to the owner of that installation and not us.