Please report security vulnerabilities via GitHub's private vulnerability reporting:

https://github.com/roboalchemist/buildbuddy-cli/security/advisories/new

You will receive an acknowledgment within 48 hours.