The latest minor release (0.x) receives security fixes. Older minors do not.

Email security@codeotter.io, or use GitHub's private vulnerability reporting on this repository. Do not open a public issue. You get an acknowledgement within 72 hours and a fix or a plan within 14 days for confirmed issues.

In scope: core/, tui/, the web UI, the Docker image and bin/install.sh. Out of scope: the models themselves and third-party services you connect.