Security fixes target the current Paletide macOS release and the main branch. The unfinished code under windows/ is retained for future development and is not currently covered by release or security-support commitments.

安全修复面向 Paletide 当前 macOS 正式版本和 main 分支。windows/ 中尚未完成的代码仅供后续开发参考，当前不属于正式发布或安全支持范围。

Do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability report so maintainers can investigate before details are disclosed.

怀疑存在安全漏洞时，请勿提交公开 Issue。请使用 GitHub 的私密漏洞报告，让维护者能在细节公开前完成核查和修复。

Include only the information needed to reproduce the issue:

• affected Paletide version or commit;
• macOS and Codex / ChatGPT Desktop versions;
• expected impact and minimal reproduction steps;
• the smallest relevant, sanitized log excerpt.

请只提供复现所需的信息：受影响的 Paletide 版本或提交、macOS 与 Codex / ChatGPT Desktop 版本、预期影响、最小复现步骤和已脱敏的必要日志片段。

Never include these values in a report, screenshot, attachment, public issue, or pull request:

• API keys, relay tokens, Base URLs with credentials, auth.json, cookies, or session data;
• complete diagnostic archives or logs containing usernames and local paths;
• private Codex conversations, user-imported artwork, customer data, or unredacted screenshots.

无论私密报告还是公开协作，都不要提交 API Key、中转密钥、带凭证的 Base URL、auth.json、Cookie、会话数据、包含用户名路径的完整诊断包、私人对话、用户图片、客户数据或未脱敏截图。旧版 Paletide 的授权码、租约文件、安装标识或钥匙串内容同样不得附在报告中。

Replace sensitive values with stable placeholders and keep only the lines needed to demonstrate the issue. If a secret was exposed, revoke or rotate it before continuing the report.

请用稳定占位符替换敏感值，只保留证明问题所需的最少内容。如果凭证已经泄露，请先撤销或轮换，再继续报告。

High-value reports include unexpected non-loopback CDP exposure, process identity validation bypasses, unsafe file or symlink traversal, mutation of the official application, official-application signature validation bypasses, and unintended disclosure of local themes or credentials. Paletide 2.1.0 and later do not have an account, license-code activation, authorization server, or license gate.

重点安全问题包括：CDP 意外暴露到非回环地址、进程身份校验绕过、不安全的文件或符号链接越界、修改官方应用、官方应用签名校验绕过，以及本地主题或凭证意外泄露。Paletide 2.1.0 及后续版本不再包含账号、授权码激活、授权服务器或授权门禁。