VShell is pre-1.0 software. Security fixes are prepared for the latest release and the main branch.

Please do not post exploitable details in a public issue.

Use GitHub's private vulnerability reporting for this repository if it is enabled. If private reporting is not available yet, open a minimal public issue asking for a private security contact and do not include exploit steps, secrets, crash payloads, or affected host details.

Include this information in the private report when possible:

• VShell version or commit hash
• Operating system and architecture
• A short impact summary
• Reproduction steps or proof of concept
• Whether credentials, host files, backups, or update installation are affected

We will acknowledge valid reports as quickly as possible, investigate the issue, and publish a fix or mitigation when one is ready.

• VShell stores saved hosts locally. Saved passwords are encrypted before storage.
• Backup exports are encrypted with a user-provided code.
• SFTP host keys are pinned after first connection and blocked if they change.
• Remote file previews are limited to the configured Tauri asset protocol scope.
• Auto-update installers come from GitHub Releases. Public releases should use signed installers.