rox parses untrusted files (audio, tags, cover art, playlists, lyrics) and talks to a handful of web services. If you've found a way to make that dangerous, say memory corruption from a crafted file, path traversal through an m3u, or credentials leaking somewhere, I want to know.

Report privately through GitHub's vulnerability reporting or email andrew@zealsprince.com. If you'd rather reach me somewhere else, zealsprince.com links out to everywhere I'm active. Don't open a public issue for anything exploitable. You'll hear back within a week, and you'll be credited in the fix unless you'd rather not be.

The latest release and main. Crashes without a security angle are regular bugs; the bug report form is the right door for those.