Security

If you believe you have found a security vulnerability in the Steroid CLI, its install scripts or steroidkit.com, email [email protected]. Please report it privately first rather than in a public issue or post, so we can fix it before it is widely known.

• What the issue is and what an attacker could do with it.
• Steps to reproduce it, or a proof of concept.
• The affected version — run steroid --version — and your operating system, or the URL if it concerns the website.
• How you would like to be credited, if at all.

• Access, change or delete data that is not yours.
• Run tests that degrade the service for other people, such as load or denial-of-service tests.
• Use social engineering against us or our users.

The install command downloads and runs a script from the public steroidkit/releases repository on GitHub. You can read it first: install.sh for macOS and Linux, and install.ps1 for Windows.

In Local mode your project memory is built and stored on your device. For what the CLI sends to Steroid by default, and how to turn it off, see Telemetry and Privacy.