Security fixes are released for the latest version of cursorcam.

Please do not open a public issue for a security problem.

Report it privately with GitHub's private vulnerability reporting. Include the version, what an attacker could do, and steps to reproduce.

You will get an acknowledgement as soon as possible. Once the issue is confirmed, a fix is released and the report is credited, unless you prefer to stay anonymous.

CursorCam types logins into real sites and runs a browser on your machine, so these count as security problems:

• A $secret: or $env: value, or an ask reply, reaching a file, a log, the terminal output or an unblurred frame of the video.
• A download, upload or temp file read or written outside its run folder.
• The local render server answering a request without its random token.
• A browser or other process left running after a run ends.