Please report security vulnerabilities privately through GitHub Security Advisories rather than a public issue. Do not include real tokens, cookies, account payloads, conversations, or project data in reports.

For antivirus detections or Windows SmartScreen warnings, follow Windows download safety. Include the exact file name, download URL, SHA-256, security product, and detection name. A generic screenshot that contains no private data is welcome, but never disable security software merely to test the app.

The current default branch receives security fixes first.