Security fixes are applied to the latest released OpenDub version and the main branch during pre-release development.

Do not report vulnerabilities through public GitHub issues. Send a private report to the project maintainers using the contact mechanism published with the first public release. Include a minimal reproduction, affected version, impact, and any mitigation you have identified.

Until the public contact address is published, do not include exploit details in public channels. Maintainers will acknowledge a report, assess impact, and coordinate a fix before disclosure.

Report issues involving local file handling, media parsing, model downloads, adapter isolation, API exposure, credentials, privacy, voice-reference handling, and supply-chain integrity.