Only the latest release (and the current nightly/beta build) are supported with security fixes. Older versions won't receive backports — please update before reporting an issue.

Please do not open a public GitHub issue for security vulnerabilities.

Instead, report it privately via GitHub Security Advisories for this repo, or reach out on Discord to arrange a private disclosure.

Include:

• A description of the vulnerability and its impact.
• Steps to reproduce (a minimal repro is enough).
• The app version/build you tested on.

We'll acknowledge reports within a few days and aim to ship a fix before any public disclosure.

This covers the Convx Android app and the code in this repository. It does not cover the third-party services the app talks to (YouTube Music, Apple Music, Discord, Last.fm, etc.) — report issues in those to their respective owners.