Please report security issues privately through GitHub Security Advisories rather than opening a public issue.

• The package does not execute external code or install fonts.
• Clipboard support invokes only a locally discovered clipboard utility (wl-copy, pbcopy, or xclip) when the copy command is explicitly requested by the user.
• The generator downloads data only from the pinned Nerd Fonts release tag on GitHub over HTTPS.