Report suspected vulnerabilities through GitHub private vulnerability reporting. Do not open a public issue for an uncoordinated security report.

Include the affected version/commit, operating system, impact, and minimal reproduction. Remove project paths, VS Code databases, credentials, signing material, and other personal data.

The current v0.1.0-beta.4 Windows preview is unsigned. Verify its published SHA-256 checksum. Future supported cross-platform releases require the trust chain described in Release and rollback.