Security fixes are currently provided on the latest release line (v5.10.x as of 2026-09).

Use a private GitHub Security Advisory to report a vulnerability. Do not publish exploit details, proof-of-concept code, or other sensitive details in public issues, discussions, or pull requests before a fix is available.

Include the neoproot version, CPU architecture, host system, rootfs, command line, complete reproduction steps, and enough output to reproduce the problem. Maintainers will respond on a best-effort basis and coordinate a fix or disclosure through the advisory.

neoproot, like PRoot, uses ptrace to emulate chroot/root. It does not provide kernel-level isolation and must not be used as a security boundary for untrusted users or root filesystems.

See the Termux security policy for host-level guidance.