The latest released version of CachePilot receives security fixes.
Please do not open a public issue. Use GitHub's private vulnerability reporting: https://github.com/6t9xstar/github-actions-cache-optimizer/security/advisories/new
You will get a response within 7 days. CachePilot reads local files and never sends repository contents anywhere.