Security fixes are provided for the latest released minor version.

Do not open a public issue for a suspected vulnerability. Report it privately through GitHub's private vulnerability reporting form.

Include:

• the affected version and operating system;
• a minimal reproduction or malicious project file;
• the expected and observed behavior;
• the potential impact; and
• any known workaround.

You should receive an acknowledgement within seven days. The maintainer will coordinate validation, a fix, and disclosure. Please allow time for a patched release before publishing details.

DiffEqWorkbench parses model expressions into a restricted representation and does not intentionally evaluate arbitrary Julia code. This reduces risk but does not make the desktop application a security sandbox.

Only open project files from sources you trust. The application reads and writes local files selected by the user, and its numerical dependencies operate in the same user account as the application. Future external adapters must run as separate processes and should be treated as independent trust boundaries.