Please do not file a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting or security-advisory flow for this repository and include reproduction steps, affected versions, and the expected impact.

Only the current main branch is supported before the first stable release. Security-sensitive areas include downloaded build inputs, artifact and manifest validation, code signing, VM disk handling, the QEMU process boundary, and the guest-to-host audio bridge.

The project will acknowledge a complete report as soon as practical, assess its scope, and coordinate a fix and disclosure with the reporter.