Suspected vulnerabilities are reported privately through GitHub's Report a vulnerability form (GitHub sign-in required), rather than in public issues.

A useful report includes the affected version or commit, reproduction steps, expected and actual behavior, and the potential impact. Reproductions and attachments must use fully invented data, with no actual clipboard content, customer data or credentials.

Caviarde's detection is best-effort. The known limitations describe detection gaps; a missed fictional name or an over-masked identifier can be reported with the bug form. Suspected data exposure or a bypass of a privacy boundary belongs in the private channel above.

The detector image audit and security notes document the pinned image, the audit's scope and the residual risks, including the Detector URL preference's effect on where clipboard text is sent.