Security fixes target the latest published release. Older releases do not have a separate maintenance branch.

Use GitHub private vulnerability reporting.

Include:

• The affected package and Pi versions.
• The impact and minimal reproduction steps using synthetic data.
• A proposed fix, if available.

Never attach access tokens, credentials, private conversation content, or session files. Do not publish exploit details in issues or pull requests before coordinating disclosure with the maintainer.

This is a volunteer-maintained project. No response or resolution deadline is guaranteed.

Report unintended data disclosure, for example through recall or a handoff note, and other vulnerabilities in this extension through the private channel.

For ordinary compaction or compatibility errors, use a public bug report with sanitized details.

This extension runs inside Pi with its process permissions. Install extensions only from sources you trust.