Report vulnerabilities privately. Do not post exploit details, credentials or personal data in an issue that could later become public.

Use GitHub's Security → Report a vulnerability to submit a private security report. Do not use public Issues for vulnerabilities. No email or social-media reporting channel is provided. Privacy requests about repository submissions may use the same private form with Privacy request in the title; general support requests are not accepted there.

Include the version/build, impact, reproduction steps and relevant OS details. There is no guaranteed response time. Fixes target the latest maintained release and source.

The scanner processes untrusted metadata without loading plugin code. The app does not load plugin code or run an automatic plugin update service. Limited removal uses confirmation, filesystem checks and a verified local backup by default. Signing and notarisation do not establish that software is free of vulnerabilities.