Please do not open a public GitHub issue for security-related bugs.

Email details to lucaszhouc@gmail.com with the subject prefix [SECURITY]. I will acknowledge within 7 days on a best-effort basis. This is a single-maintainer fork with no formal SLA; if a fix is time-sensitive on your side, please say so in the email.

If you would like to disclose publicly after a fix is out, we can coordinate a timeline over email.

Only the latest main branch and the most recent tagged release receive security fixes.

This policy covers the code in this repository (the Ink-styled chrome, the AI-analyze surface, and fork-specific integration glue). Upstream QuickLook vulnerabilities should be reported to QL-Win/QuickLook directly — they have a larger reviewer pool and quicker response.