This is a small, actively developed project — only the latest release receives security fixes. Please update before assuming a report is still open.

If you find a security issue in this project (for example, something that could let a file/folder name or other input trigger unintended commands, or gain more privilege than expected), please do not open a public GitHub issue with exploit details.

Instead, please report it privately using GitHub's built-in flow:

Report a vulnerability (repo → Security tab → "Report a vulnerability")

Please include, if possible:

• Affected version(s)
• Steps to reproduce
• What an attacker could do with it (impact)

I'll do my best to acknowledge new reports within a few days. The goal is to get a fix out before any public write-up, so users have a chance to update first. Once a fixed version is released, I'll publish the details as a GitHub Security Advisory (and credit you as the reporter, if you'd like).

• Security fixes are called out briefly in the changelog/release notes at a high level (what area was affected, that you should update) without exploit details.
• Full technical details will be published separately as a GitHub Security Notice 3 days after the version is released.

E-mail: readonlynux@proton.me