Code Universe is currently pre-1.0. Security fixes are applied to the latest version on the default branch and, when practical, to the latest published Mac release. Older builds are not supported.

Do not disclose a suspected vulnerability in a public issue, discussion, pull request, screenshot, or sample repository.

Report it privately through the VCLab contact page and include:

• the affected version or commit;
• the affected component and platform;
• reproduction steps or a minimal proof of concept;
• the likely impact;
• whether the issue has been disclosed elsewhere.

Do not include real credentials, private source code, customer data, or destructive payloads. You should receive an acknowledgement within five business days. A status update or request for more information should follow after initial triage. Publication and remediation timing will be coordinated according to severity.

Code Universe is designed to scan project contents locally. Reports involving project-boundary escapes, unintended network transmission, command execution, licence-signature bypass, secret exposure, update integrity, or release-signing integrity are especially important.

This project does not currently operate a paid bug-bounty programme.