Before the first stable release, security fixes are made on the default branch. After stable releases begin, the latest release will receive security fixes.

Use GitHub private vulnerability reporting when it is available for this repository. Include the affected version or commit, impact, reproduction steps, and any suggested mitigation.

If private reporting is unavailable, open a minimal issue asking the maintainers for a private contact channel. Do not include exploit details, private files, security-scoped bookmark data, local paths, credentials, or personal information in a public issue.

Ordinary crashes and functional defects can use the public issue tracker. Safety-control failures, sandbox escapes, unintended file access, and ways to prevent emergency dismissal should be treated as security-sensitive.