Only the latest release on main (and tags cut from it) receives security fixes.

Please do not report security vulnerabilities through public GitHub issues.

Instead:

1. Use GitHub's private vulnerability reporting on this repository, or
2. Open a GitHub issue asking for a private channel, and we will follow up.

We acknowledge vulnerability reports within 7 days and provide an initial assessment within 14 days. Confirmed vulnerabilities are fixed and disclosed coordinately with the reporter; timelines depend on severity and release complexity.

• The bridge binary and its configuration handling
• Credential storage (config.yaml, user_login metadata)
• The realtime socket and kChat API client (pkg/connector)

Bridge configuration files contain appservice tokens and kChat access tokens. Never attach real configuration files or logs with tokens to public reports; redact them first.