Security fixes are applied to the latest main branch.

Please do not report vulnerabilities in public issues.

Instead:

1. Email the maintainer: mike.holownych+chromatui-security@proton.me
2. Include reproduction details, impact assessment, and affected paths.
3. If available, include a minimal proof-of-concept.

You should receive an acknowledgement within 3 business days.

• We will validate and triage the report.
• We will coordinate a fix and release window.
• We will credit reporters unless anonymity is requested.