The latest tagged release and the current forge branch receive security fixes. Older releases are unsupported; upgrade before reporting a problem that is already fixed.

Use GitHub's private vulnerability report. Do not open a public issue.

Include the affected version and platform, impact, minimal reproduction, and any suggested mitigation. Remove tokens, personal data, and unrelated machine details from logs. Reports should concern Keys Tools itself, including unsafe manifest handling, command execution, release artifacts, or its build and publication pipeline.

The maintainer aims to acknowledge a report within seven days, provide a status update within fourteen days, and coordinate disclosure after a fix is available. Timelines may change with severity and reproducibility. There is no bug bounty program.