Slick is actively developed. Security fixes are targeted at the latest release and the current main branch; older releases are not actively maintained. Please update to the latest release before reporting a vulnerability.

Please report vulnerabilities in Slick privately through GitHub's vulnerability reporting page. Do not open a public issue or pull request containing exploit details, credentials, Slack tokens, private messages, or other sensitive data.

This policy covers Slick's own code, installers, updates, and packaged extension. For vulnerabilities in Slack itself or other third-party software, report them to the respective vendor. If you are unsure whether Slick is involved, report privately here first and I can make sure it gets to the right place.