Clean BOM Senior modifies files in place. Its security surface is therefore unusual for a CLI: the worst possible bug is not a crash but a silent, wrong write. This policy treats the following as security issues:

1. Data corruption — any code path that writes bytes a user did not ask for: touching UTF-16/32 or NUL-binary files, adding/removing trailing newlines, breaking hard links or symlinks, half-written files after a crash or a full disk.
2. Arbitrary-write / path traversal — writing outside the selected scope (e.g. following directory symlinks during the walk, temp-file races in shared directories, backup paths escaping --backup-dir).
3. Update channel — anything that weakens --update verification (shebang + embedded version stamp), allows a redirect to an attacker-controlled host, or lets a downloaded script run before verification.
4. Injection — the reference is a shell script: any construct that lets a filename execute as code (eval, unquoted expansions) is a vulnerability. (v3 removed the eval-based find expression of v2.)

• Atomic same-directory temp + verified rename(2); rollback copies for in-place rewrites; temps are mktemp-created (0600) and registered for cleanup on signals.
• Hard refusals that no flag can override (UTF-16/32, NUL-binary) — docs/SMART-BOM.md §3.
• The walk never follows symlinks; symlink arguments are resolved and logged; the tool never deletes user files.
• No telemetry; network access only on explicit --check-update/--update.
• Both suites assert the corruption guarantees with raw-byte fixtures (docs/TESTING.md), including "clean file ⇒ inode & mtime stable".

Please do not open a public issue for anything in the scope above.

• Email: mid1977@gmail.com (repository owner)
• Include: version (--version), platform, a minimal reproduction with raw bytes (od -An -tx1), and the impact (which guarantee is broken).
• We aim to acknowledge within 72 hours and to ship a fix (and, when the issue is exploitable via the update channel, a release note) before public disclosure. Coordinate disclosure timing with us — npm and GitHub release artifacts are involved.