lockwatch is a read-only dependency review tool. Scan only source trees and lockfiles that you are authorized to inspect. The default mode is offline; use synthetic fixtures for development and tests.

Please do not put credentials, private lockfiles, or exploit details in a public issue. Open a private GitHub security report when available, or contact the maintainer through the GitHub profile with a minimal reproduction and the affected version.