Do not open a public issue for security problems. Report them privately through Security > Report a vulnerability on the repository (private vulnerability reporting). Include the version you tested, the platform, and steps to reproduce.

You can expect an initial response within 7 days. Once the issue is confirmed, a fix is prepared and released, and the reporter is credited unless they prefer to stay anonymous.

In scope: the Tauri backend (src-tauri/), the frontend (src/), the release workflow and published artifacts. Out of scope: the upstream core binary and third-party dependencies (report those to their own maintainers).