Security fixes are applied to the latest published release and the default branch. Pre-release builds are supported on a best-effort basis.

Please do not open a public issue for a suspected vulnerability involving credential exposure, arbitrary code execution, navigation bypass, or unsafe IPC.

Use GitHub's private vulnerability reporting feature under Security > Advisories > Report a vulnerability. Include:

• affected version and Windows version;
• reproduction steps or a minimal proof of concept;
• expected and observed behavior;
• whether an API Key or local conversation data could be exposed;
• any suggested mitigation, if available.

Maintainers should acknowledge a complete report within seven days. A fix and disclosure schedule depends on severity and reproducibility. Please allow a reasonable remediation period before public disclosure.

API Keys are encrypted with Electron safeStorage, backed by Windows DPAPI, and are only decrypted in the Electron main process. The renderer receives only a boolean indicating that a key exists. API requests reject redirects and do not intentionally log secrets.

Conversation history is local application data and is not encrypted by this project. Anyone with access to the unlocked Windows account may be able to read it. Users should protect their Windows account and disk appropriately.

Never attach a real API Key, connections.json, user-data directory, or private conversation transcript to an issue.