The Notch installs hooks into AI agent configs, runs a local Unix socket server and can approve agent commands, so security reports are taken seriously.

Please do not open a public issue. Use GitHub's private vulnerability reporting instead. Include steps to reproduce and the version you tested.

You should get a reply within a week. Once a fix ships, you will be credited in the release notes unless you would rather not be.

Only the latest release receives security fixes.