ProGhostty supports the latest release and one prior minor version.

If you're running an unsupported version, please update before reporting — the issue may already be fixed.

Do not open a public GitHub issue for security vulnerabilities.

Use GitHub's private vulnerability reporting:

1. Go to the Security tab
2. Click Report a vulnerability
3. Include as much detail as possible:
   • Affected version(s)
   • Steps to reproduce
   • Impact assessment
   • Suggested fix (if you have one)

A good security report helps us respond faster. Please describe:

• What — the vulnerability and its attack surface
• How — steps to reproduce or a proof of concept
• Impact — what an attacker could do (data access, code execution, denial of service, etc.)
• Scope — which component is affected (see below)

We may reach out for clarification during the assessment. If the issue is confirmed, we'll work on a fix and coordinate disclosure with you.

• We fix confirmed vulnerabilities and include the fix in the next release.
• After the fix is released, we publish a security advisory via GitHub Security Advisories.
• We credit reporters unless they prefer to remain anonymous.
• We ask that you do not publicly disclose the vulnerability until we've released the fix and coordinated the announcement.

The following components are in scope for security reports:

• Issues in upstream Ghostty that do not affect ProGhostty's usage (report to Ghostty directly)
• Issues in user shell configurations (zsh, fish, etc.)
• General macOS vulnerabilities unrelated to ProGhostty

We appreciate the security research community's efforts in responsibly disclosing vulnerabilities. Thank you for helping keep ProGhostty and its users safe.