Security fixes target the latest source on main and the latest tagged release.

Use GitHub's private vulnerability reporting for this repository. Do not open a public issue containing mailbox addresses, contact data, OAuth material, local paths, or an exploitable proof of concept.

Include the affected version, macOS version, reproducible steps using synthetic data, the security boundary crossed, and the smallest evidence needed to understand the issue. Remove tokens, OAuth JSON, sender libraries, images, and diagnostics before attaching files.

Ordinary bugs and source-quality problems can use public issues when they contain no private user data.