Only the latest release is supported — please update before reporting an issue.

Please do not open a public issue for security vulnerabilities.

Instead, report privately via GitHub's private vulnerability reporting.

I will do my best to acknowledge reports within 2 weeks and aim to release a fix or mitigation within 6 weeks for confirmed issues; timelines are best-effort.

terrafmt parses and rewrites untrusted input — terraform blocks embedded in markdown documentation and Go test files. Issues where crafted input causes crashes, hangs, or writes outside the file being formatted are particularly relevant.