Please don't open a public issue for security problems. Report them privately through GitHub's private vulnerability reporting.

Include what you found, how to reproduce it, and the impact. You'll get a reply within a few days.

• The Kitty Chrome extension (kitty/extension)
• The Kitty server (kitty/server) and the hosted instance at kitty-server.vercel.app

Of particular interest: leaked API keys, prompt injection that makes Kitty act against the user, and ways to abuse the hosted server.

Only the latest release receives fixes.