Only the latest release on the Releases page receives security fixes.

Please do not open a public issue. Report it privately through GitHub Security Advisories.

Include what you found, how to reproduce it, and the impact you expect. You'll get an answer within 7 days; once a fix is released we'll credit you in the release notes (unless you'd rather stay anonymous).

In scope: the Android app in this repository, its build and release pipeline. Out of scope: third-party websites, the yt-dlp and NewPipe projects (report to them directly), and issues that need a rooted or already-compromised device.