Only the latest release gets fixes. Because this is an NVDA add-on, the practical support boundary is also NVDA's: it requires NVDA 2024.1 or newer.

Report privately, not in a public issue:

• Open a private security advisory on this repository, or
• Email ozcitakbilal@gmail.com.

Include what an attacker can do, and the steps to reproduce it. You should get an acknowledgement within a week. If a fix is warranted it will ship in the next release, with credit unless you would rather stay anonymous.

This add-on runs inside NVDA, which means it runs with the user's privileges and, when NVDA is installed as a system screen reader, can be active on the secure desktop. Things that count:

• Code paths that could execute arbitrary code from a file the add-on reads (WAV files are parsed with Python's wave module).
• Anything that could crash or hang NVDA itself — a screen reader that stops responding leaves a blind user with no way to use the machine, so a reliable hang is treated as a real security problem here, not a mere bug.
• Reading or writing outside the add-on's own directory and its NVDA config section.

Out of scope: vulnerabilities in NVDA itself (report those to nvaccess/nvda), and issues that need an attacker to already have code execution as the user.