Please report security issues privately:
- GitHub Security Advisories (preferred)
Do not open public issues for vulnerabilities.
- RomM API tokens or passwords
- OS keyring exports or
config.jsonwith real credentials - Live server URLs that include credentials
We address security issues on the latest released versions tracked in docs/compatibility.toml. Upgrade to the newest romm-api, romm-cli, and romm-tui tags before reporting when possible.