Security fixes are applied to the latest stable release and the current development branch. Users should reproduce a suspected issue with the latest release when it is safe to do so.

Do not open a public issue for a suspected vulnerability, signing-key compromise, release-pipeline compromise, credential exposure, or a weakness that could put users or their data at risk.

Use GitHub's private vulnerability reporting form:

https://github.com/ucx0204/CarrotMangaTranslator/security/advisories/new

Include:

• the affected version and operating system;
• the security impact and the conditions required to trigger it;
• concise reproduction steps or a minimal proof of concept;
• the relevant component, file, or release artifact;
• any mitigation you have already tested.

Do not attach private manga images, credentials, access tokens, API keys, or raw logs. Remove personal paths and project content from diagnostic material. If a credential may have been exposed, revoke or rotate it before sending the report.

The maintainer will review the report, may request additional information, and will coordinate disclosure after a fix or mitigation is available. No response or resolution deadline is guaranteed.

Use the public issue tracker for ordinary bugs, compatibility problems, feature requests, and non-confidential code-signing policy questions.