Do not open a public issue for a suspected vulnerability.

Use GitHub's Report a vulnerability form on the repository Security page. That creates a private security advisory visible only to the repository's security managers and the reporter. There is no public security intake email.

Include the affected commit, platform, reproduction steps, impact, and whether credentials or private artifacts may have been exposed. Do not include live tokens, cookies, private keys, provider-home contents, or customer data.

Only the most recent signed stable bundle and the exact public-source commit named by that release are eligible for security fixes.

• Never put credentials in argv, logs, issues, fixtures, screenshots, or committed examples.
• Treat provider homes, browser storage, Loop artifacts, account sessions, and updater trust state as private local material.
• Preserve hashes and provenance when reporting an artifact; redact bodies unless the private advisory explicitly needs them.
• Installer and updater authenticity failures must fail closed. Do not bypass a signature, trust-root, target, archive, or anti-rollback error.