Security fixes are released as PATCH versions of the latest MINOR version of each app (see docs/releasing.md).

Please do not open a public issue. Report it privately through GitHub: Security → Report a vulnerability on this repository (private vulnerability reporting).

Include what you found, how to reproduce it, and the version affected. We aim to answer within a week, and will credit you in the advisory unless you prefer otherwise.

OpenShuttle desktop runs offline and opens tournament files (.openshuttle, SQLite). A crafted file that crashes the app, corrupts data or runs code is in scope.