Report vulnerabilities through private vulnerability reporting. Keep vulnerability details out of public issues, pull requests and discussions.

Include the impact, reproduction steps or a proof of concept, and your kururu and macOS versions. Security fixes target the latest release. Give the maintainer time to investigate and ship a fix before public disclosure; reporters can request credit. This community project does not promise a response time.

Reports should concern kururu's integrity, local data, misuse of its permissions or release/update integrity. Report issues in external services to their providers. Official releases from v0.1.2 use Apple Developer ID signing and notarization.