localhost runs your commands, reads process information and keeps Secrets in the system's secret store, so security reports matter to us.

Please don't open a public issue. Report it privately through GitHub's security advisories with what you found, how to reproduce it, and which version and platform you used.

You'll get an answer within a week. Once a fix is released, the advisory is published with credit to you, unless you'd rather not be named.

Only the latest release gets security fixes.