Please do not open a public issue for security problems.

Report it privately through GitHub instead: go to the Security tab of this repository and click Report a vulnerability (direct link). Include what you found, how to reproduce it, and the impact you expect.

This is a personal project maintained in spare time. You can expect an acknowledgement within a week. Fixes are released as soon as practical, and you'll be credited in the advisory unless you prefer otherwise.

Of particular interest: checks that report PASS on an insecure configuration, and anything in the generated remediation scripts that could weaken a system or run unintended commands.

Only the latest version on the main branch receives security fixes.