English | 简体中文

Security reports are accepted for the current v1.0.0 Beta release and the current main branch. Older 0.x development builds are not maintained. Beta status does not provide a response-time or fix-time guarantee.

Use GitHub private vulnerability reporting. You need to sign in to GitHub. Reports are shared with the repository's authorized security collaborators rather than published as issues.

Include the affected version, impact, reproduction steps, and a minimal example using content you are permitted to share. Relevant areas include extension permissions, message validation, unintended data disclosure, downloaded-file handling, and dependency vulnerabilities.

Do not submit cookies, access tokens, browser profiles, signed media URLs, or private media. Use a test account or sanitized example. Do not access another person's account or data to demonstrate an issue.

Please allow private coordination before publishing exploit details. If GitHub reporting is temporarily unavailable, do not post the vulnerability in a public issue; wait for the private channel to become available. This project does not publish a separate security email address or offer a bug bounty.

Use Issues for layout problems, unsupported formats, and ordinary download failures that do not expose a security vulnerability.