Do not open a public issue for security vulnerabilities.

Instead, please report them responsibly:

1. Email: security@stream-shogun.dev (or open a private security advisory on GitHub).
2. Include a description of the vulnerability, steps to reproduce, and any potential impact.
3. We will acknowledge receipt within 48 hours and aim to provide a fix within 7 days for critical issues.

StreamShōgun follows the Electron Security Checklist:

• Dependabot is enabled for automated dependency updates.
• pnpm audit runs in CI on every pull request.
• Native modules (better-sqlite3) are pinned and rebuilt per platform.

We follow coordinated disclosure. After a fix is released, we will publish a security advisory crediting the reporter.