If you discover a security vulnerability in tmpkit, please report it responsibly.

1. Do NOT open a public GitHub issue.
2. Email mathias.paulenko@outlook.com with a description of the vulnerability and, if possible, a proof of concept.
3. You will receive an acknowledgment within 48 hours.
4. We will investigate and, if confirmed, release a fix as soon as possible depending on severity.

• We follow coordinated disclosure.
• A CVE may be requested for significant vulnerabilities.
• Credit will be given to the reporter (unless they prefer to remain anonymous).

tmpkit is a zero-dependency library that wraps Python's tempfile module. The main security considerations are:

• Temp file permissions: Uses tempfile.mkstemp() which creates files with restrictive permissions (0600 on Unix).
• Symlink attacks: Uses shutil.rmtree() for directory cleanup. On Python 3.11+, this is protected against symlink attacks by default.
• Path traversal: Temp paths are generated by the stdlib and are not user-controlled beyond suffix, prefix, and dir parameters. If you pass a user-controlled dir, validate it.