Security fixes target the current 0.2.x release line. The 0.1.x line is no longer the supported target. Check the selected release's verification record for its separate preview and readiness limits.

Do not open a public issue for a suspected vulnerability. Use the repository's private security advisory flow and include a minimal reproduction, affected version, and impact.

Do not include passwords, verification codes, saved-session material, browser data, private profile data, or personal identifiers in a report. If a report needs sensitive proof, describe the shape of the issue and wait for a maintainer response.

OrbitDiff handles owner-supplied personal relationship exports and separately collected public following lists. Security reports are especially useful for export isolation, credential handling, local file permissions, SQLite access, package contents, command injection, and collection outside those documented sources.