Please do not report security problems in a public issue.

Use Report a vulnerability on the repository's Security tab: the report reaches the author privately, and the fix is prepared in a private fork before anything is published. You can write in English or Russian.

If GitHub is not an option, write to @nerual_dreming on Telegram.

Fixes are published in a new release, with an advisory that credits the reporter unless they ask otherwise.

Only the latest release of each project receives security fixes. Update from the repository's Releases page or through the app's own updater.