Security Policy
Supported Versions
Security updates are provided for the latest stable release.
Version Supported Latest stable release Yes Older versions No
Please update to the latest version before reporting a vulnerability.
Reporting a Vulnerability
Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
If you believe you have found a security vulnerability, please report it privately using GitHub’s private vulnerability reporting feature.
When reporting a vulnerability, please include:
- A clear description of the issue
- Steps to reproduce the issue
- The affected version or commit
- The affected operating system and environment
- The potential impact
- Any proof-of-concept code, logs, screenshots, or crash reports, if applicable
Response Expectations
After receiving a vulnerability report, we will try to:
- Acknowledge the report within 7 days
- Investigate and validate the issue
- Provide updates when there is meaningful progress
- Release a fix if the issue is confirmed
Response times may vary depending on the complexity and severity of the report.
Public Disclosure
Please do not publicly disclose the vulnerability until a fix has been released or until we have agreed on a coordinated disclosure timeline.
Public disclosure before a fix is available may put users at risk.
Scope
Security issues may include, but are not limited to:
- Remote code execution
- Command injection
- Path traversal
- Unauthorized file access
- Unsafe handling of credentials, tokens, or secrets
- Privilege escalation
- Insecure update behavior
- Electron IPC security issues
The following are generally out of scope unless they demonstrate a concrete security impact:
- Reports from automated scanners without analysis
- Missing security headers without a practical exploit
- Denial-of-service issues requiring unrealistic local access
- Vulnerabilities affecting unsupported versions only
- Social engineering attacks
- Physical access attacks
Security Updates
Security fixes will be released through the normal release channels.
Users are encouraged to keep the application up to date.