Pullo reads your GitHub token from the GitHub CLI, so security reports are taken seriously.

Please don't open a public issue. Report it privately through GitHub instead, with the steps to reproduce it and what an attacker could do with it.

You'll get an answer within a few days. Once it's fixed, the release notes credit you, unless you'd rather stay anonymous.

Only the latest release gets security fixes. Pullo updates itself, so most people are already on it.