Security reports are welcome for the current main branch. Important areas include path confinement, token checks, symbolic links, unintended file changes, browser injection, and exposure beyond the local machine.
Do not publish a vulnerability or private path in a public issue. Use the repository host's private vulnerability-reporting channel when available. If it is not available, contact the maintainer privately through the same channel that provided the project.
Include a concise description, affected version or commit, reproduction steps using synthetic data, and the expected security boundary. Never attach real user files, credentials, or private directory names.
Reports will be acknowledged, reproduced, and assessed before a public fix or disclosure. No response time or bounty is promised.