Trust

Security and privacy

How to report a problem, what the CLI does on your machine, and what this site keeps about you.

Report a vulnerability

Do not open a public issue. Use GitHub's private vulnerability report for the CLI repository and include the CLI version, Node.js version, operating system, a minimal reproduction, and the impact. Maintainers confirm receipt, coordinate a fix, and publish details only after a fixed release is available. Template-only issues should also be reported to that template's repository. Fixes go to the latest release line; the full security policy is in the repository.

What the CLI downloads and runs

Templates at pinned commits. create fetches the chosen template from GitHub with Git at a full, immutable commit hash built into the CLI release, and refuses the download if the fetched commit does not match.
Your package manager. It runs npm, pnpm, Yarn, or Bun to install the template's dependencies, unless you pass --no-install. Commands run without a shell; on Windows, package-manager shims that need cmd.exe accept only simple arguments, and anything else is refused.
Nothing else. The CLI has no telemetry or analytics and sends nothing about you or your project. Its only runtime dependencies are chalk, ora, and prompts.
Local writes only. Generators write inside the project, preview with --dry-run, refuse symlinked paths, and roll back on failure. check --architecture runs the Steiger you installed and downloads nothing.

Secrets in generated projects

Variables prefixed VITE_, NEXT_PUBLIC_, NUXT_PUBLIC_, or PUBLIC_ end up in the browser bundle. Put only public values there.
The Supabase adapter needs only the public URL and the publishable or anon key. Never ship a service-role or secret key to the browser, and enforce access with Row Level Security.
When you extend the generated auth code, never log passwords, one-time codes, or tokens, including in error handlers.
Templates include Dependabot and a dependency-security workflow. Keep them enabled and merge security updates promptly.

What this site stores

No analytics, tracking scripts, or advertising cookies. The site does not ask for or store personal data from readers.
Your light or dark theme choice is saved in your browser's local storage and never leaves your device.
The home page loads public download and star counts directly from the npm and GitHub APIs, so your browser contacts those services.
Documentation videos are embedded from youtube-nocookie.com, YouTube's privacy-enhanced mode.
The maintainer dashboard uses a Supabase sign-in session cookie for maintainers only. Readers never see or need it.
Like any website, the hosting provider may keep standard request logs such as IP address and user agent.