Only the latest release gets security fixes.

Please report privately through GitHub's private vulnerability reporting. Do not open a public issue for a security problem.

Include what you found, how to reproduce it, and the version and OS. You can expect an acknowledgement within 7 days and a fix or a plan within 30 days for confirmed issues. Credit is given in the release notes unless you ask otherwise.

In scope: the desktop app (IPC and capabilities, process launching, config storage, theme and group import), the release artifacts and workflows, and the website.

The design and the threats we defend against are in docs/THREAT_MODEL.md.

Each release publishes SHA256SUMS.txt beside the artifacts. The installers are not code-signed; see docs/RELEASING.md. Updates installed from Settings are signed with the release key and verified before they install.