Report vulnerabilities in the shop CLI, the @shopify/shop package, or this repository through Shopify's HackerOne program at https://hackerone.com/shopify. Do not open a public issue for a security report.