Please do not open a public issue for a security problem.

Report it privately through GitHub: Report a vulnerability.

Include the package name and version, what an attacker can do, and the smallest reproduction you can share. We reply within 5 working days and keep you updated until a fix ships.

Arki packages are below 1.0. Fixes land in the latest published version of each package. Older versions do not get backports.