Only the latest release gets fixes.

Please don't open a public issue. Report it privately through GitHub's private vulnerability reporting (Security tab → Report a vulnerability).

You'll get an answer within a week. Once it's fixed, we'll publish an advisory and credit you, unless you'd rather stay anonymous.

Paradiddle has no network access, no accounts and asks for no permissions; it only stores your practice history and settings on your device. Still relevant: anything that could crash the app or corrupt data from crafted input, problems in the build or release process, or a compromised dependency.