Please report vulnerabilities privately through GitHub: open the repository's Security tab and choose Report a vulnerability. Don't open a public issue for them.

Jevis runs as a hook inside your coding agent and handles prompts, commands, and an API key, so reports about secret handling, command injection, or anything that leaks session content are especially welcome.