Report vulnerabilities privately through GitHub: open the repository's Security tab and choose Report a vulnerability. Do not open a public issue for a vulnerability, and do not include exploit details or private data in public discussions.

Fixes are made on main and shipped in the next release; only the latest release is supported.

What vosu installs, reads, listens on, and changes on your system is described in the security and installation disclosure. Network requests are covered by the privacy policy, and release signing by the code signing policy.