Please report vulnerabilities through GitHub private vulnerability reporting. Do not include exploit details, credentials, real messages, or personal data in a public issue.

Include the affected version and platform, reproduction steps using synthetic messages or accounts, the expected behavior, and the observed impact. Remove tokens, server names, message bodies, and addresses from logs and screenshots. The in-app diagnostic export redacts known sensitive fields; review it before sharing.

Security fixes are made on main and included in subsequent nightly and stable releases. Older releases do not have a separate maintenance branch.