Report vulnerabilities privately through GitHub: open the repository's Security tab and choose Report a vulnerability. Do not open a public issue for a vulnerability, and do not include exploit details or private data in public discussions.

Fixes are made on main and shipped in the next release; only the latest release is supported.

What vosulay installs, injects, listens on and sends is described in the security and installation disclosure. Releases and their signing are covered by the code signing policy.