Report vulnerabilities privately through this repository's GitHub security reporting when enabled. If it is unavailable, open an issue asking for a private reporting channel without publishing exploit details, credentials, recordings or local filesystem paths.

ClipDeck is pre-release and has no supported stable release yet. Security-sensitive boundaries include project parsing/relink authority, source identity, media capabilities, native job cancellation, resource integrity, renderer isolation and explicit model acquisition. The product does not upload media for transcription.

Include the commit or artifact hash, operating system, minimal sanitized reproduction and expected boundary. Preserve secure defaults while investigating; disabling sandboxing or operating-system protections is not a supported workaround.