Decksmith is an early preview. Keep Fedora and Decksmith updated, and install only from the official infamous-pattern/decksmith repository.

See the preview security review for tested boundaries, resolved findings and remaining limitations. Release checksums are integrity checks, not signatures. Plugins currently run with desktop-user access.

For a suspected vulnerability, avoid posting credentials or a working exploit in a public issue. Use GitHub's private vulnerability-reporting option if enabled; otherwise open a minimal issue requesting a private reporting channel, without including sensitive details. Ordinary non-sensitive bug reports can use Issues.