NectarLink handles sensitive data such as notifications, messages, one-time codes and files, so security reports are taken seriously.

Please don't open a public issue for security problems.

Report privately through GitHub's private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability.

Please include:

• what the issue is and its impact,
• steps to reproduce, or a proof of concept,
• the affected versions (desktop app, Android app, Windows and Android versions).

• An acknowledgement within 7 days.
• Updates as the issue is investigated and fixed.
• Credit in the release notes once a fix ships, if you'd like it.

Please give us a reasonable amount of time to release a fix before disclosing the issue publicly.

Security fixes go into the latest release. Both apps update themselves from GitHub Releases, so keeping Check for updates on is the way to get them.