Only the latest release (v2.4.0 and above) receives security fixes. Older versions should be updated as soon as possible.

Please report vulnerabilities privately via the Report a vulnerability button on the Security tab — do not open a public issue.

Windows release binaries are code-signed via SignPath Foundation (pending approval). The certificate is issued to SignPath Foundation. To verify, right-click the installer → Properties → Digital Signatures.

This project is maintained by a single developer on a best-effort basis. I aim to acknowledge reports within 7 days. Fix timelines depend on severity and availability.